Monitoring of call information in a wireless location system

ABSTRACT

In an overlay Wireless Location System, an Abis interface is monitored to obtain information used to locate GSM phones. Signaling links of the Abis interface are passively monitored to obtain certain information, such as control and traffic channel assignment, called number, and mobile identification, which is not available from the GSM air interface of the reverse channel. This approach also applies to IDEN and can be broadened to include CDMA systems where the GSM architecture has been used and the system includes a separated BTS to BSC interface.

CROSS REFERENCE TO RELATED APPLICATIONS

This is a continuation-in-part of U.S. patent application Ser. No.09/539,352, filed Mar. 31, 2000, “Centralized Database for a WirelessLocation System,” now U.S. Pat. No. 6,317,604 B1 issued Nov. 13, 2001,which is a continuation of U.S. patent application Ser. No. 09/227,764,filed Jan. 8, 1999, now U.S. Pat. No. 6,184,829 B1, Feb. 6, 2001,“Calibration for Wireless Location System.”

FIELD OF THE INVENTION

The present invention relates generally to methods and apparatus forlocating wireless transmitters, such as those used in analog or digitalcellular systems, personal communications systems (PCS), enhancedspecialized mobile radios (ESMRs), and other types of wirelesscommunications systems. More particularly, the present invention relatesto the collection of call information from the wireless network'snon-air interfaces to facilitate location via TDOA, AOA, and/or TDOA/AOAhybrid wireless location systems in wireless systems having a separatedBase Transceiver Station (BTS) and Base Station Controller (BSC).

BACKGROUND OF THE INVENTION

Early work relating to Wireless Location Systems is described in U.S.Pat. No. 5,327,144, Jul. 5, 1994, “Cellular Telephone Location System,”which discloses a system for locating cellular telephones using noveltime difference of arrival (TDOA) techniques. Further enhancements ofthe system disclosed in the '144 patent are disclosed in U.S. Pat. No.5,608,410, Mar. 4, 1997, “System for Locating a Source of BurstyTransmissions.” Both of these patents are assigned to TruePosition,Inc., the assignee of the present invention, and both are incorporatedherein by reference. TruePosition has continued to develop significantenhancements to the original inventive concepts and have developedtechniques to further improve the accuracy of Wireless Location Systemswhile significantly reducing the cost of these systems. Patents relatingto such enhancements include, but are not necessarily limited to: U.S.Pat. No. 6,091,362, Jul. 18, 2000, “Bandwidth Synthesis for WirelessLocation System”; U.S. Pat. No. 6,097,336, Aug. 1, 2000, “Method forImproving the Accuracy of a Wireless Location System”; U.S. Pat. No.6,115,599, Sep. 5, 2000, “Directed Retry Method for Use in a WirelessLocation System”; U.S. Pat. No. 6,172,644 B1, Jan. 9, 2001, “EmergencyLocation Method for a Wireless Location System”; and U.S. Pat. No.6,184,829 B1, Feb. 6, 2001, “Calibration for Wireless Location System.”

Over the past few years, the cellular industry has increased the numberof air interface protocols available for use by wireless telephones,increased the number of frequency bands in which wireless or mobiletelephones may operate, and has expanded the number of terms that referor relate to mobile telephones to include “personal communicationsservices”, “wireless”, and others. The air interface protocols nowinclude AMPS, N-AMPS, TDMA, CDMA, GSM, TACS, ESMR, GPRS, EDGE, andothers. The changes in terminology and increases in the number of airinterfaces do not change the basic principles and inventions discoveredand enhanced by the inventors. However, in keeping with the currentterminology of the industry, the inventors now call the system describedherein a Wireless Location System.

The inventors have conducted extensive experiments with the WirelessLocation System technology to demonstrate both the viability and valueof the technology. For example, several experiments were conductedduring several months of 1995 and 1996 in the cities of Philadelphia andBaltimore to verify the system's ability to mitigate multipath in largeurban environments. Then, in 1996 the inventors constructed a system inHouston that was used to test the technology's effectiveness in thatarea and its ability to interface directly with E9-1-1 systems. Then, in1997, the system was tested in a 350 square mile area in New Jersey andwas used to locate real 9-1-1 calls from real people in trouble. Sincethat time, the system test has been expanded to include 125 cell sitescovering an area of over 2,000 square miles. During all of these tests,techniques discussed and disclosed herein were tested for effectivenessand further developed, and the system has been demonstrated to overcomethe limitations of other approaches that have been proposed for locatingwireless telephones.

The value and importance of the Wireless Location System has beenacknowledged by the wireless communications industry. In June 1996, theFederal Communications Commission issued requirements for the wirelesscommunications industry to deploy location systems for use in locatingwireless 9-1-1 callers, with a deadline of October 2001. The location ofwireless E9-1-1 callers will save response time, save lives, and saveenormous costs because of reduced use of emergency responses resources.In addition, numerous surveys and studies have concluded that variouswireless applications, such as location sensitive billing, fleetmanagement, and others, will have great commercial values in the comingyears.

Background on Wireless Communications Systems

There are many different types of air interface protocols used forwireless communications systems. These protocols are used in differentfrequency bands, both in the U.S. and internationally. The frequencyband does not impact the Wireless Location System's effectiveness atlocating wireless telephones.

All air interface protocols use two types of “channels”. The first typeincludes control channels that are used for conveying information aboutthe wireless telephone or transmitter, for initiating or terminatingcalls, or for transferring bursty data. For example, some types of shortmessaging services transfer data over the control channel. In differentair interfaces, control channels are known by different terminology, butthe use of the control channels in each air interface is similar.Control channels generally have identifying information about thewireless telephone or transmitter contained in the transmission. Controlchannels also include various data transfer protocols that are not voicespecific—these include General Packet Radio Service (GPRS), EnhancedData rate for GSM Evolution (EDGE), and Enhanced GPRS (EGPRS).

The second type includes voice channels that are typically used forconveying voice communications over the air interface. These channelsare only used after a call has been set up using the control channels.Voice channels will typically use dedicated resources within thewireless communications system whereas control channels will use sharedresources. This distinction will generally make the use of controlchannels for wireless location purposes more cost effective than the useof voice channels, although there are some applications for whichregular location on the voice channel is desired. Voice channelsgenerally do not have identifying information about the wirelesstelephone or transmitter in the transmission. Some of the differences inthe air interface protocols are discussed below:

AMPS—This is the original air interface protocol used for cellularcommunications in the U.S. In the AMPS system, separate dedicatedchannels are assigned for use by control channels (RCC). According tothe TIA/EIA Standard IS-553A, every control channel block must begin atcellular channel 333 or 334, but the block may be of variable length. Inthe U.S., by convention, the AMPS control channel block is 21 channelswide, but the use of a 26-channel block is also known. A reverse voicechannel (RVC) may occupy any channel that is not assigned to a controlchannel. The control channel modulation is FSK (frequency shift keying),while the voice channels are modulated using FM (frequency modulation).

N-AMPS—This air interface is an expansion of the AMPS air interfaceprotocol, and is defined in EIA/TIA standard IS-88. The control channelsare substantially the same as for AMPS; however, the voice channels aredifferent. The voice channels occupy less than 10 KHz of bandwidth,versus the 30 KHz used for AMPS, and the modulation is FM.

TDMA—This interface is also known D-AMPS, and is defined in EIA/TIAstandard IS-136. This air interface is characterized by the use of bothfrequency and time separation. Control channels are known as DigitalControl Channels (DCCH) and are transmitted in bursts in timeslotsassigned for use by DCCH. Unlike AMPS, DCCH may be assigned anywhere inthe frequency band, although there are generally some frequencyassignments that are more attractive than others based upon the use ofprobability blocks. Voice channels are known as Digital Traffic Channels(DTC). DCCH and DTC may occupy the same frequency assignments, but notthe same timeslot assignment in a given frequency assignment. DCCH andDTC use the same modulation scheme, known as π/4 DQPSK (differentialquadrature phase shift keying). In the cellular band, a carrier may useboth the AMPS and TDMA protocols, as long as the frequency assignmentsfor each protocol are kept separated. A carrier may also aggregatedigital channels together to support higher speed data transferprotocols such as GPRS and EDGE.

CDMA—This air interface is defined by EIA/TIA standard IS-95A. This airinterface is characterized by the use of both frequency and codeseparation. However, because adjacent cell sites may use the samefrequency sets, CDMA is also characterized by very careful powercontrol. This careful power control leads to a situation known to thoseskilled in the art as the near-far problem, which makes wirelesslocation difficult for most approaches to function properly. Controlchannels are known as Access Channels, and voice channels are known asTraffic Channels. Access and Traffic Channels may share the samefrequency band, but are separated by code. Access and Traffic Channelsuse the same modulation scheme, known as OQPSK. CDMA can support higherspeed data transfer protocols by aggregating codes together.

GSM—the international standard Global System for Mobile Communicationsdefines this air interface. Like TDMA, GSM is characterized by the useof both frequency and time separation. The channel bandwidth is 200 KHz,which is wider than the 30 KHz used for TDMA. Control channels are knownas Standalone Dedicated Control Channels (SDCCH), and are transmitted inbursts in timeslots assigned for use by SDCCH. SDCCH may be assignedanywhere in the frequency band. Voice channels are known as TrafficChannels (TCH). SDCCH and TCH may occupy the same frequency assignments,but not the same timeslot assignment in a given frequency assignment.SDCCH and TCH use the same modulation scheme, known as GMSK. GSM canalso support higher data transfer protocols such as GPRS and EGPRS.

Within this specification the reference to any one of the air interfacesmay refer to all of the air interfaces, unless specified otherwise.Additionally, a reference to control channels or voice channels mayrefer to all types of control or voice channels, whatever the preferredterminology for a particular air interface. Finally, there are many moretypes of air interfaces used throughout the world, and there is nointent to exclude any air interface from the inventive conceptsdescribed within this specification. Indeed, those skilled in the artwill recognize other interfaces used elsewhere are derivatives of orsimilar in class to those described above.

SUMMARY OF THE INVENTION

The present invention is designed to collect wireless call associatedinformation using a non-invasive, passive collection mechanism. Theinvention may be used to determine cell, frequency, and callerinformation for purposes of directing a Wireless Location System. Forexample, in an overlay Wireless Location System, an Abis interface maybe monitored to obtain information used to locate GSM phones. In thisimplementation, signaling links of the Abis interface are passivelymonitored to obtain certain information, such as control and trafficchannel assignment, called number, and mobile identification, which isnot available from the GSM air interface of the reverse channel. Thisapproach also applies to IDEN and can be broadened to include CDMAsystems where the GSM architecture has been used and the system includesa separate BTS to BSC interface. Other features and advantages of theinvention are disclosed below.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1 and 1A schematically depict a Wireless Location System inaccordance with the present invention.

FIG. 2 schematically depicts a Signal Collection System (SCS) 10 inaccordance with the present invention.

FIG. 2A schematically depicts a receiver module 10-2 employed by theSignal Collection System.

FIGS. 2B and 2C schematically depict alternative ways of coupling thereceiver module(s) 10-2 to the antennas 10-1.

FIG. 2C-1 is a flowchart of a process employed by the Wireless LocationSystem when using narrowband receiver modules.

FIG. 2D schematically depicts a DSP module 10-3 employed in the SignalCollection System in accordance with the present invention.

FIG. 2E is a flowchart of the operation of the DSP module(s) 10-3, andFIG. 2E-1 is a flowchart of the process employed by the DSP modules fordetecting active channels.

FIG. 2F schematically depicts a Control and Communications Module 10-5in accordance with the present invention.

FIGS. 2G-2J depict aspects of the presently preferred SCS calibrationmethods. FIG. 2G is a schematic illustration of baselines and errorvalues used to explain an external calibration method in accordance withthe present invention. FIG. 2H is a flowchart of an internal calibrationmethod. FIG. 2I is an exemplary transfer function of an AMPS controlchannel and FIG. 2J depicts an exemplary comb signal.

FIGS. 2K and 2L are flowcharts of two methods for monitoring performanceof a Wireless Location System in accordance with the present invention.

FIG. 3 schematically depicts a TDOA Location Processor 12 in accordancewith the present invention.

FIG. 3A depicts the structure of an exemplary network map maintained bythe TLP controllers in accordance with the present invention.

FIGS. 4 and 4A schematically depict different aspects of an ApplicationsProcessor 14 in accordance with the present invention.

FIG. 5 is a flowchart of a central station-based location processingmethod in accordance with the present invention.

FIG. 6 is a flowchart of a station-based location processing method inaccordance with the present invention.

FIG. 7 is a flowchart of a method for determining, for each transmissionfor which a location is desired, whether to employ central orstation-based processing.

FIG. 8 is a flowchart of a dynamic process used to select cooperatingantennas and SCS's 10 used in location processing.

FIG. 9 is diagram that is referred to below in explaining a method forselecting a candidate list of SCS's and antennas using a predeterminedset of criteria.

FIG. 10 is a simplified block diagram of a monitoring system inaccordance with the present invention.

FIG. 11 is a flowchart of a monitoring method in accordance with thepresent invention.

FIGS. 12A-12P schematically depict various aspects of a presentlypreferred implementation of the invention. Many of these depict signalformats and structures in accordance with the GSM specification. Inparticular,

FIG. 12A schematically depicts a call setup “arrow diagram” for a mobilestation-originating call;

FIG. 12B schematically depicts the structure of a Random Access Burstaccording to the GSM specification;

FIG. 12C depicts the format of an RR Channel Request Message;

FIG. 12D depicts the Request reference fields in the Channel RequiredMessage;

FIG. 12E depicts the Frame Number according to the GSM specification;

FIG. 12F depicts Encryption Information Element within the ChannelActivation Command;

FIG. 12G depicts the Channel Number Information Element;

FIG. 12H depicts the Channel Description Information Element;

FIG. 12I depicts the Bit Pattern specified for CM Service Types;

FIG. 12J depicts the MS Classmark Fields in a CM Service Request;

FIG. 12K depicts the format of the Mobile Identity fields;

FIG. 12L depicts Ciphering and Deciphering operations at the MS and BTS;

FIG. 12M depicts a cascade of messages concerning Ciphering Transitionamong the MSC, BSC, BTS and MS;

FIG. 12N depicts an Encryption Information Element within the EncryptionCommand;

FIG. 12O depicts a Called Party BCD Number; and

FIG. 12P schematically depicts an exemplary system architecture forcarrying out the present invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

A goal of the present invention is to provide a mechanism fornon-invasively collecting information concerning cell, frequency, andcaller for purposes of directing a wireless location system. Forexample, the present invention provides a method that may be used in aWireless Location System of the kind described below to locate GSMmobile phones. With the architecture described below, the system wouldnot be required to detect and demodulate messages from the mobileterminal during call setup. Instead, the WLS could ascertain call setupinformation from the interface between the BTS and the BSC, which iscommonly called the “Abis” interface. From the Abis interface, thelocation system can identify the calling party (indirectly), the calledparty (e.g., 911), and the TDMA/FDMA resource being used for a givencall at any time.

The following is a description of an illustrative WLS of the kind inwhich the present invention may be used. This description is intended toprovide the interested reader with a thorough understanding of apresently preferred environment in which the present invention may beutilized. It should be noted, however, that, except to the extent thatthey may be expressly so limited, the claims of the present applicationare by no means limited to the details of the illustrative WLS describedherein. Indeed, for example, the present invention is applicable toWireless Location Systems characterized as TDOA systems, AOA systems,and hybrid TDOA/AOA systems. Following the description of theillustrative WLS, presently preferred embodiments of the inventivemethod for non-invasively collecting call information are described.

Overview of WLS

A Wireless Location System, or WLS, may be configured to operate as apassive overlay to a wireless communications system, such as a cellular,PCS, or ESMR system, although the concepts are not limited to just thosetypes of communications systems. Wireless communications systems aregenerally not suitable for locating wireless devices because the designsof the wireless transmitters and cell sites do not include the necessaryfunctionality to achieve accurate location. Accurate location in thisapplication is defined as accuracy of 100 to 400 feet RMS (root meansquare). This is distinguished from the location accuracy that can beachieved by existing cell sites, which is generally limited to theradius of the cell site. In general, cell sites are not designed orprogrammed to cooperate between and among themselves to determinewireless transmitter location. Additionally, wireless transmitters suchas cellular and PCS telephones are designed to be low cost and thereforegenerally do not have locating capability built-in. A WLS may bedesigned to be a low cost addition to a wireless communications systemthat involves minimal changes to cell sites and no changes at all tostandard wireless transmitters. The system may be considered passivebecause it does not contain transmitters, and therefore does not causeinterference to the wireless communications system.

As shown in FIG. 1, the Wireless Location System has four major kinds ofsubsystems: the Signal Collection Systems (SCS's) 10, the TDOA LocationProcessors (TLP's) 12, the Application Processors (AP's) 14, and theNetwork Operations Console (NOC) 16. Each SCS is responsible forreceiving the RF signals transmitted by the wireless transmitters onboth control channels and voice channels. In general, each SCS ispreferably installed at a wireless carrier's cell site, and thereforeoperates in parallel to a base station. Each TLP 12 is responsible formanaging a network of SCS's 10 and for providing a centralized pool ofdigital signal processing (DSP) resources that can be used in thelocation calculations. The SCS's 10 and the TLP's 12 operate together todetermine the location of the wireless transmitters, as will bediscussed more fully below. Digital signal processing is the preferablemanner in which to process radio signals because DSP's are relativelylow cost, provide consistent performance, and are easily re-programmableto handle many different tasks. Both the SCS's 10 and TLP's 12 contain asignificant amount of DSP resources, and the software in these systemscan operate dynamically to determine where to perform a particularprocessing function based upon tradeoffs in processing time,communications time, queuing time, and cost. Each TLP 12 existscentrally primarily to reduce the overall cost of implementing theWireless Location System, although the techniques discussed herein arenot limited to the preferred architecture shown. That is, DSP resourcescan be relocated within the Wireless Location System without changingthe basic concepts and functionality disclosed.

The AP's 14 are responsible for managing all of the resources in theWireless Location System, including all of the SCS's 10 and TLP's 12.Each AP 14 also contains a specialized database that contains “triggers”for the Wireless Location System. In order to conserve resources, theWireless Location System can be programmed to locate only certainpre-determined types of transmissions. When a transmission of apre-determined type occurs, then the Wireless Location System istriggered to begin location processing. Otherwise, the Wireless LocationSystem may be programmed to ignore the transmission. Each AP 14 alsocontains applications interfaces that permit a variety of applicationsto securely access the Wireless Location System. These applications may,for example, access location records in real time or non-real time,create or delete certain type of triggers, or cause the WirelessLocation System to take other actions. Each AP 14 is also capable ofcertain post-processing functions that allow the AP 14 to combine anumber of location records to generate extended reports or analysesuseful for applications such as traffic monitoring or RF optimization.

The NOC 16 is a network management system that provides operators of theWireless Location System easy access to the programming parameters ofthe Wireless Location System. For example, in some cities, the WirelessLocation System may contain many hundreds or even thousands of SCS's 10.The NOC is the most effective way to manage a large Wireless LocationSystem, using graphical user interface capabilities. The NOC will alsoreceive real time alerts if certain functions within the WirelessLocation System are not operating properly. These real time alerts canbe used by the operator to take corrective action quickly and prevent adegradation of location service. Experience with trials of the WirelessLocation System show that the ability of the system to maintain goodlocation accuracy over time is directly related to the operator'sability to keep the system operating within its predeterminedparameters.

Readers of U.S. Pat. Nos. 5,327,144 and 5,608,410 and this specificationwill note similarities between the respective systems. Indeed, thesystem disclosed herein is significantly based upon and alsosignificantly enhanced from the system described in those previouspatents. For example, the SCS 10 has been expanded and enhanced from theAntenna Site System described in U.S. Pat. No. 5,608,410. The SCS 10 nowhas the capability to support many more antennas at a single cell site,and further can support the use of extended antennas as described below.This enables the SCS 10 to operate with the sectored cell sites nowcommonly used. The SCS 10 can also transfer data from multiple antennasat a cell site to the TLP 12 instead of always combining data frommultiple antennas before transfer. Additionally, the SCS 10 can supportmultiple air interface protocols thereby allowing the SCS 10 to functioneven as a wireless carrier continually changes the configuration of itssystem.

The TLP 12 is similar to the Central Site System disclosed in U.S. Pat.No. 5,608,410, but has also been expanded and enhanced. For example, theTLP 12 has been made scaleable so that the amount of DSP resourcesrequired by each TLP 12 can be appropriately scaled to match the numberof locations per second required by customers of the Wireless LocationSystem. In order to support scaling for different Wireless LocationSystem capacities, a networking scheme has been added to the TLP 12 sothat multiple TLP's 12 can cooperate to share RF data across wirelesscommunication system network boundaries. Additionally, the TLP 12 hasbeen given control means to determine the SCS's 10, and more importantlythe antennas at each of the SCS's 10, from which the TLP 12 is toreceive data in order to process a specific location. Previously, theAntenna Site Systems automatically forwarded data to the Central SiteSystem, whether requested or not by the Central Site System.Furthermore, the SCS 10 and TLP 12 combined have been designed withadditional means for removing multipath from the received transmissions.

The Database Subsystem of the Central Site System has been expanded anddeveloped into the AP 14. The AP 14 can support a greater variety ofapplications than previously disclosed in U.S. Pat. No. 5,608,410,including the ability to post-process large volumes of location recordsfrom multiple wireless transmitters. This post-processed data can yield,for example, very effective maps for use by wireless carriers to improveand optimize the RF design of the communications systems. This can beachieved, for example, by plotting the locations of all of the callersin an area and the received signal strengths at a number of cell sites.The carrier can then determine whether each cell site is, in fact,serving the exact coverage area desired by the carrier. The AP 14 canalso now store location records anonymously, that is, with the MINand/or other identity information removed from the location record, sothat the location record can be used for RF optimization or trafficmonitoring without causing concerns about an individual user's privacy.

As shown in FIG. 1A, a presently preferred implementation of theWireless Location System includes a plurality of SCS regions each ofwhich comprises multiple SCS's 10. For example, “SCS Region 1” includesSCS's 10A and 10B (and preferably others, not shown) that are located atrespective cell sites and share antennas with the base stations at thosecell sites. Drop and insert units 11A and 11B are used to interfacefractional T1/E1 lines to full T1/E1 lines, which in turn are coupled toa digital access and control system (DACS) 13A. The DACS 13A and anotherDACS 13B are used in the manner described more fully below forcommunications between the SCS's 10A, 10B, etc., and multiple TLP's 12A,12B, etc. As shown, the TLP's are typically collocated andinterconnected via an Ethernet network (backbone) and a second,redundant Ethernet network. Also coupled to the Ethernet networks aremultiple AP's 14A and 14B, multiple NOC's 16A and 16B, and a terminalserver 15. Routers 19A and 19B are used to couple one Wireless LocationSystem to one or more other Wireless Location System(s).

Signal Collection System 10

Generally, cell sites will have one of the following antennaconfigurations: (i) an omnidirectional site with 1 or 2 receive antennasor (ii) a sectored site with 1, 2, or 3 sectors, and with 1 or 2 receiveantennas used in each sector. As the number of cell sites has increasedin the U.S. and internationally, sectored cell sites have become thepredominant configuration. However, there are also a growing number ofmicro-cells and pico-cells, which can be omnidirectional. Therefore, theSCS 10 has been designed to be configurable for any of these typicalcell sites and has been provided with mechanisms to employ any number ofantennas at a cell site.

The basic architectural elements of the SCS 10 remain the same as forthe Antenna Site System described in U.S. Pat. No. 5,608,410, butseveral enhancements have been made to increase the flexibility of theSCS 10 and to reduce the commercial deployment cost of the system. Themost presently preferred embodiment of the SCS 10 is described herein.The SCS 10, an overview of which is shown in FIG. 2, includes digitalreceiver modules 10-2A through 10-2C; DSP modules 10-3A through 10-3C; aserial bus 10-4, a control and communications module 10-5; a GPS module10-6; and a clock distribution module 10-7. The SCS 10 has the followingexternal connections: power, fractional T1/E1 communications, RFconnections to antennas, and a GPS antenna connection for the timinggeneration (or clock distribution) module 10-7. The architecture andpackaging of the SCS 10 permit it to be physically collocated with cellsites (which is the most common installation place), located at othertypes of towers (such as FM, AM, two-way emergency communications,television, etc.), or located at other building structures (such asrooftops, silos, etc.).

Timing Generation

The Wireless Location System depends upon the accurate determination oftime at all SCS's 10 contained within a network. Several differenttiming generation systems have been described in previous disclosures,however the most presently preferred embodiment is based upon anenhanced GPS receiver 10-6. The enhanced GPS receiver differs from mosttraditional GPS receivers in that the receiver contains algorithms thatremove some of the timing instability of the GPS signals, and guaranteesthat any two SCS's 10 contained within a network can receive timingpulses that are within approximately ten nanoseconds of each other.These enhanced GPS receivers are now commercially available, and furtherreduce some of the time reference related errors that were observed inprevious implementations of wireless location systems. While thisenhanced GPS receiver can produce a very accurate time reference, theoutput of the receiver may still have an unacceptable phase noise.Therefore, the output of the receiver is input to a low phase noise,crystal oscillator-driven phase locked loop circuit that can now produce10 MHz and one pulse per second (PPS) reference signals with less than0.01 degrees RMS of phase noise, and with the pulse output at any SCS 10in a Wireless Location System network within ten nanoseconds of anyother pulse at another SCS 10. This combination of enhanced GPSreceiver, crystal oscillator, and phase locked loop is now the mostpreferred method to produce stable time and frequency reference signalswith low phase noise.

The SCS 10 has been designed to support multiple frequency bands andmultiple carriers with equipment located at the same cell site. This cantake place by using multiple receivers internal to a single SCS chassis,or by using multiple chassis each with separate receivers. In the eventthat multiple SCS chassis are placed at the same cell site, the SCS's 10can share a single timing generation/clock distribution circuit 10-7 andthereby reduce overall system cost. The 10 MHz and one PPS outputsignals from the timing generation circuit are amplified and bufferedinternal to the SCS 10, and then made available via external connectors.Therefore a second SCS can receive its timing from a first SCS using thebuffered output and the external connectors. These signals can also bemade available to base station equipment collocated at the cell site.This might be useful to the base station, for example, in improving thefrequency re-use pattern of a wireless communications system.

Receiver Module 10-2 (Wideband Embodiment)

When a wireless transmitter makes a transmission, the Wireless LocationSystem must receive the transmission at multiple SCS's 10 located atmultiple geographically dispersed cell sites. Therefore, each SCS 10 hasthe ability to receive a transmission on any RF channel on which thetransmission may originate. Additionally, since the SCS 10 is capable ofsupporting multiple air interface protocols, the SCS 10 also supportsmultiple types of RF channels. This is in contrast to most current basestation receivers, which typically receive only one type of channel andare usually capable of receiving only on select RF channels at each cellsite. For example, a typical TDMA base station receiver will onlysupport 30 KHz wide channels, and each receiver is programmed to receivesignals on only a single channel whose frequency does not change often(i.e. there is a relatively fixed frequency plan). Therefore, very fewTDMA base station receivers would receive a transmission on any givenfrequency. As another example, even though some GSM base stationreceivers are capable of frequency hopping, the receivers at multiplebase stations are generally not capable of simultaneously tuning to asingle frequency for the purpose of performing location processing. Infact, the receivers at GSM base stations are programmed to frequency hopto avoid using an RF channel that is being used by another transmitterso as to minimize interference.

The SCS receiver module 10-2 is preferably a dual wideband digitalreceiver that can receive the entire frequency band and all of the RFchannels of an air interface. For cellular systems in the U.S., thisreceiver module is either 15 MHz wide or 25 MHz wide so that all of thechannels of a single carrier or all of the channels of both carriers canbe received. This receiver module has many of the characteristics of thereceiver previously described in U.S. Pat. No. 5,608,410, and FIG. 2A isa block diagram of the currently preferred embodiment. Each receivermodule contains an RF tuner section 10-2-1, a data interface and controlsection 10-2-2 and an analog to digital conversion section 10-2-3. TheRF tuner section 10-2-1 includes two full independent digital receivers(including Tuner #1 and Tuner #2) that convert the analog RF input froman external connector into a digitized data stream. Unlike most basestation receivers, the SCS receiver module does not perform diversitycombining or switching. Rather, the digitized signal from eachindependent receiver is made available to the location processing. Thepresent inventors have determined that there is an advantage to thelocation processing, and especially the multipath mitigation processing,to independently process the signals from each antenna rather thanperform combining on the receiver module.

The receiver module 10-2 performs, or is coupled to elements thatperform, the following functions: automatic gain control (to supportboth nearby strong signals and far away weak signals), bandpassfiltering to remove potentially interfering signals from outside of theRF band of interest, synthesis of frequencies needed for mixing with theRF signals to create an IF signal that can be sampled, mixing, andanalog to digital conversion (ADC) for sampling the RF signals andoutputting a digitized data stream having an appropriate bandwidth andbit resolution. The frequency synthesizer locks the synthesizedfrequencies to the 10 MHz reference signal from the clockdistribution/timing generation module 10-7 (FIG. 2). All of the circuitsused in the receiver module maintain the low phase noise characteristicsof the timing reference signal. The receiver module preferably has aspurious free dynamic range of at least 80 dB.

The receiver module 10-2 also contains circuits to generate testfrequencies and calibration signals, as well as test ports wheremeasurements can be made by technicians during installation ortroubleshooting. Various calibration processes are described in furtherdetail below. The internally generated test frequencies and test portsprovide an easy method for engineers and technicians to rapidly test thereceiver module and diagnose any suspected problems. This is alsoespecially useful during the manufacturing process.

One of the advantages of the Wireless Location System described hereinis that no new antennas are required at cell sites. The WirelessLocation System can use the existing antennas already installed at mostcell sites, including both omni-directional and sectored antennas. Thisfeature can result in significant savings in the installation andmaintenance costs of the Wireless Location System versus otherapproaches that have been described in the prior art. The SCS's digitalreceivers 10-2 can be connected to the existing antennas in two ways, asshown in FIGS. 2B and 2C, respectively. In FIG. 2B, the SCS receivers10-2 are connected to the existing cell site multi-coupler or RFsplitter. In this manner, the SCS 10 uses the cell site's existing lownoise pre-amplifier, band pass filter, and multi-coupler or RF splitter.This type of connection usually limits the SCS 10 to supporting thefrequency band of a single carrier. For example, an A-side cellularcarrier will typically use the band pass filter to block signals fromcustomers of the B-side carrier, and vice versa.

In FIG. 2C, the existing RF path at the cell site has been interrupted,and a new pre-amplifier, band pass filter, and RF splitter has beenadded as part of the Wireless Location System. The new band pass filterwill pass multiple contiguous frequency bands, such as both the A-sideand B-side cellular carriers, thereby allowing the Wireless LocationSystem to locate wireless transmitters using both cellular systems butusing the antennas from a single cell site. In this configuration, theWireless Location System uses matched RF components at each cell site,so that the phase versus frequency responses are identical. This is incontrast to existing RF components, which may be from differentmanufacturers or using different model numbers at various cell sites.Matching the response characteristics of RF components reduces apossible source of error for the location processing, although theWireless Location System has the capability to compensate for thesesources of error. Finally, the new pre-amplifier installed with theWireless Location System will have a very low noise figure to improvethe sensitivity of the SCS 10 at a cell site. The overall noise figureof the SCS digital receivers 10-2 is dominated by the noise figure ofthe low noise amplifiers. Because the Wireless Location System can useweak signals in location processing, whereas the base station typicallycannot process weak signals, the Wireless Location System cansignificantly benefit from a high quality, very low noise amplifier.

In order to improve the ability of the Wireless Location System toaccurately determine TDOA for a wireless transmission, the phase versusfrequency response of the cell site's RF components are determined atthe time of installation and updated at other certain times and thenstored in a table in the Wireless Location System. This can be importantbecause, for example, the band pass filters and/or multi-couplers madeby some manufacturers have a steep and non-linear phase versus frequencyresponse near the edge of the pass band. If the edge of the pass band isvery near to or coincident with the reverse control or voice channels,then the Wireless Location System would make incorrect measurements ofthe transmitted signal's phase characteristics if the Wireless LocationSystem did not correct the measurements using the storedcharacteristics. This becomes even more important if a carrier hasinstalled multi-couplers and/or band pass filters from more than onemanufacturer, because the characteristics at each site may be different.In addition to measuring the phase versus frequency response, otherenvironmental factors may cause changes to the RF path prior to the ADC.These factors require occasional and sometimes periodic calibration inthe SCS 10.

Alternative Narrowband Embodiment of Receiver Module 10-2

In addition or as an alternative to the wideband receiver module, theSCS 10 also supports a narrowband embodiment of the receiver module10-2. In contrast to the wideband receiver module that cansimultaneously receive all of the RF channels in use by a wirelesscommunications system, the narrowband receiver can only receive one or afew RF channels at a time. For example, the SCS 10 supports a 60 KHznarrowband receiver for use in AMPS/TDMA systems, covering twocontiguous 30 KHz channels. This receiver is still a digital receiver asdescribed for the wideband module, however the frequency synthesizingand mixing circuits are used to dynamically tune the receiver module tovarious RF channels on command. This dynamic tuning can typically occurin one millisecond or less, and the receiver can dwell on a specific RFchannel for as long as required to receive and digitize RF data forlocation processing.

The purpose of the narrowband receiver is to reduce the implementationcost of a Wireless Location System from the cost that is incurred withwideband receivers. Of course, there is some loss of performance, butthe availability of these multiple receivers permits wireless carriersto have more cost/performance options. Additional inventive functionsand enhancements have been added to the Wireless Location System tosupport this new type of narrowband receiver. When the wideband receiveris being used, all RF channels are received continuously at all SCS's10, and subsequent to the transmission, the Wireless Location System canuse the DSP's 10-3 (FIG. 2) to dynamically select any RF channel fromthe digital memory. With the narrowband receiver, the Wireless LocationSystem must ensure a priori that the narrowband receivers at multiplecell sites are simultaneously tuned to the same RF channel so that allreceivers can simultaneously receive, digitize and store the samewireless transmission. For this reason, the narrowband receiver isgenerally used only for locating voice channel transmissions, which canbe known a priori to be making a transmission. Since control channeltransmissions can occur asynchronously at any time, the narrowbandreceiver may not be tuned to the correct channel to receive thetransmission.

When the narrowband receivers are used for locating AMPS voice channeltransmissions, the Wireless Location System has the ability totemporarily change the modulation characteristics of the AMPS wirelesstransmitter to aid location processing. This may be necessary becauseAMPS voice channels are only FM modulated with the addition of a lowlevel supervisory tone known as SAT. As is known in the art, theCramer-Rao lower bound of AMPS FM modulation is significantly worse thanthe Manchester encoded FSK modulation used for AMPS reverse channels and“blank and burst” transmissions on the voice channel. Further, AMPSwireless transmitters may be transmitting with significantly reducedenergy if there is no modulating input signal (i.e., no one isspeaking). To improve the location estimate by improving the modulationcharacteristics without depending on the existence or amplitude of aninput modulating signal, the Wireless Location System can cause an AMPSwireless transmitter to transmit a “blank and burst” message at a pointin time when the narrowband receivers at multiple SCS's 10 are tuned tothe RF channel on which the message will be sent. This is furtherdescribed later.

The Wireless Location System performs the following steps when using thenarrowband receiver module (see the flowchart of FIG. 2C-1):

a first wireless transmitter is a priori engaged in transmitting on aparticular RF channel;

the Wireless Location System triggers to make a location estimate of thefirst wireless transmitter (the trigger may occur either internally orexternally via a command/response interface);

the Wireless Location System determines the cell site, sector, RFchannel, timeslot, long code mask, and encryption key (all informationelements may not be necessary for all air interface protocols) currentlyin use by the first wireless transmitter;

the Wireless Location System tunes an appropriate first narrowbandreceiver at an appropriate first SCS 10 to the RF channel and timeslotat the designated cell site and sector, wherein appropriate typicallymeans both available and collocated or in closest proximity;

the first SCS 10 receives a time segment of RF data, typically rangingfrom a few microseconds to tens of milliseconds, from the firstnarrowband receiver and evaluates the transmission's power, SNR, andmodulation characteristics;

if the transmission's power or SNR is below a predetermined threshold,the Wireless Location System waits a predetermined length of time andthen returns to the above third step (where the Wireless Location Systemdetermines the cell site, sector, etc.);

if the transmission is an AMPS voice channel transmission and themodulation is below a threshold, then the Wireless Location Systemcommands the wireless communications system to send a command to thefirst wireless transmitter to cause a “blank and burst” on the firstwireless transmitter;

the Wireless Location System requests the wireless communications systemto prevent hand-off of the wireless transmitter to another RF channelfor a predetermined length of time;

the Wireless Location System receives a response from the wirelesscommunications system indicating the time period during which the firstwireless transmitter will be prevented from handing-off, and ifcommanded, the time period during which the wireless communicationssystem will send a command to the first wireless transmitter to cause a“blank and burst”;

the Wireless Location System determines the list of antennas that willbe used in location processing (the antenna selection process isdescribed below);

the Wireless Location System determines the earliest Wireless LocationSystem timestamp at which the narrowband receivers connected to theselected antennas are available to begin simultaneously collecting RFdata from the RF channel currently in use by the first wirelesstransmitter;

based upon the earliest Wireless Location System timestamp and the timeperiods in the response from the wireless communications system, theWireless Location System commands the narrowband receivers connected tothe antennas that will be used in location processing to tune to thecell site, sector, and RF channel currently in use by the first wirelesstransmitter and to receive RF data for a predetermined dwell time (basedupon the bandwidth of the signal, SNR, and integration requirements);

the RF data received by the narrowband receivers are written into thedual port memory;

location processing on the received RF data commences, as described inU.S. Pat. Nos. 5,327,144 and 5,608,410 and in sections below;

the Wireless Location System again determines the cell site, sector, RFchannel, timeslot, long code mask, and encryption key currently in useby the first wireless transmitter;

if the cell site, sector, RF channel, timeslot, long code mask, andencryption key currently in use by the first wireless transmitter haschanged between queries (i.e. before and after gathering the RF data)the Wireless Location System ceases location processing, causes an alertmessage that location processing failed because the wireless transmitterchanged transmission status during the period of time in which RF datawas being received, and re-triggers this entire process;

location processing on the received RF data completes in accordance withthe steps described below.

The determination of the information elements including cell site,sector, RF channel, timeslot, long code mask, and encryption key (allinformation elements may not be necessary for all air interfaceprotocols) is typically obtained by the Wireless Location System througha command/response interface between the Wireless Location System andthe wireless communications system.

The use of the narrowband receiver in the manner described above isknown as random tuning because the receivers can be directed to any RFchannel on command from the system. One advantage to random tuning isthat locations are processed only for those wireless transmitters forwhich the Wireless Location System is triggered. One disadvantage torandom tuning is that various synchronization factors, including theinterface between the wireless communications system and the WirelessLocation System and the latency times in scheduling the necessaryreceivers throughout the system, can limit the total location processingthroughput. For example, in a TDMA system, random tuning used throughoutthe Wireless Location System will typically limit location processingthroughput to about 2.5 locations per second per cell site sector.

Therefore, the narrowband receiver also supports another mode, known asautomatic sequential tuning, which can perform location processing at ahigher throughput. For example, in a TDMA system, using similarassumptions about dwell time and setup time as for the narrowbandreceiver operation described above, sequential tuning can achieve alocation processing throughput of about 41 locations per second per cellsite sector, meaning that all 395 TDMA RF channels can be processed inabout 9 seconds. This increased rate can be achieved by taking advantageof, for example, the two contiguous RF channels that can be receivedsimultaneously, location processing all three TDMA timeslots in an RFchannel, and eliminating the need for synchronization with the wirelesscommunications system. When the Wireless Location System is using thenarrowband receivers for sequential tuning, the Wireless Location Systemhas no knowledge of the identity of the wireless transmitter because theWireless Location System does not wait for a trigger, nor does theWireless Location System query the wireless communications system forthe identity information prior to receiving the transmission. In thismethod, the Wireless Location System sequences through every cell site,RF channel and time slot, performs location processing, and reports alocation record identifying a time stamp, cell site, RF channel, timeslot, and location. Subsequent to the location record report, theWireless Location System and the wireless communications system matchthe location records to the wireless communications system's dataindicating which wireless transmitters were in use at the time, andwhich cell sites, RF channels, and time slots were used by each wirelesstransmitter. Then, the Wireless Location System can retain the locationrecords for wireless transmitters of interest, and discard thoselocation records for the remaining wireless transmitters.

Digital Signal Processor Module 10-3

The SCS digital receiver modules 10-2 output a digitized RF data streamhaving a specified bandwidth and bit resolution. For example, a 15 MHzembodiment of the wideband receiver may output a data stream containing60 million samples per second, at a resolution of 14 bits per sample.This RF data stream will contain all of the RF channels that are used bythe wireless communications system. The DSP modules 10-3 receive thedigitized data stream, and can extract any individual RF channel throughdigital mixing and filtering. The DSP's can also reduce the bitresolution upon command from the Wireless Location System, as needed toreduce the bandwidth requirements between the SCS 10 and TLP 12. TheWireless Location System can dynamically select the bit resolution atwhich to forward digitized baseband RF data, based upon the processingrequirements for each location. DSP's are used for these functions toreduce the systemic errors that can occur from mixing and filtering withanalog components. The use of DSP's allows perfect matching in theprocessing between any two SCS's 10.

A block diagram of the DSP module 10-3 is shown is FIG. 2D, and theoperation of the DSP module is depicted by the flowchart of FIG. 2E. Asshown in FIG. 2D, the DSP module 10-3 comprises the following elements:a pair of DSP elements 10-3-1A and 10-3-1B, referred to collectively asa “first” DSP; serial to parallel converters 10-3-2; dual port memoryelements 10-3-3; a second DSP 10-3-4; a parallel to serial converter; aFIFO buffer; a DSP 10-3-5 (including RAM) for detection, another DSP10-3-6 for demodulation, and another DSP 10-3-7 for normalization andcontrol; and an address generator 10-3-8. In a presently preferredembodiment, the DSP module 10-3 receives the wideband digitized datastream (FIG. 2E, step S1), and uses the first DSP (10-3-1A and 10-3-1B)to extract blocks of channels (step S2). For example, a first DSPprogrammed to operate as a digital drop receiver can extract four blocksof channels, wherein each block includes at least 1.25 MHz of bandwidth.This bandwidth can include 42 channels of AMPS or TDMA, 6 channels ofGSM, or 1 channel of CDMA. The DSP does not require the blocks to becontiguous, as the DSP can independently digitally tune to any set of RFchannels within the bandwidth of the wideband digitized data stream. TheDSP can also perform wideband or narrow band energy detection on all orany of the channels in the block, and report the power levels by channelto the TLP 12 (step S3). For example, every 10 ms, the DSP can performwideband energy detection and create an RF spectral map for all channelsfor all receivers (see step S9). Because this spectral map can be sentfrom the SCS 10 to the TLP 12 every 10 ms via the communications linkconnecting the SCS 10 and the TLP 12, a significant data overhead couldexist. Therefore, the DSP reduces the data overhead by companding thedata into a finite number of levels. Normally, for example, 84 dB ofdynamic range could require 14 bits. In the companding processimplemented by the DSP, the data is reduced, for example, to only 4 bitsby selecting 16 important RF spectral levels to send to the TLP 12. Thechoice of the number of levels, and therefore the number of bits, aswell as the representation of the levels, can be automatically adjustedby the Wireless Location System. These adjustments are performed tomaximize the information value of the RF spectral messages sent to theTLP 12 as well as to optimize the use of the bandwidth available on thecommunications link between the SCS 10 and the TLP 12.

After conversion, each block of RF channels (each at least 1.25 MHz) ispassed through serial to parallel converter 10-3-2 and then stored indual port digital memory 10-3-3 (step S4). The digital memory is acircular memory, which means that the DSP module begins writing datainto the first memory address and then continues sequentially until thelast memory address is reached. When the last memory address is reached,the DSP returns to the first memory address and continues tosequentially write data into memory. Each DSP module typically containsenough memory to store several seconds of data for each block of RFchannels to support the latency and queuing times in the locationprocess.

In the DSP module, the memory address at which digitized and convertedRF data is written into memory is the time stamp used throughout theWireless Location System and which the location processing references indetermining TDOA. In order to ensure that the time stamps are aligned atevery SCS 10 in the Wireless Location System, the address generator10-3-8 receives the one pulse per second signal from the timinggeneration/clock distribution module 10-7 (FIG. 2). Periodically, theaddress generator at all SCS's 10 in a Wireless Location System willsimultaneously reset themselves to a known address. This enables thelocation processing to reduce or eliminate accumulated timing errors inthe recording of time stamps for each digitized data element.

The address generator 10-3-8 controls both writing to and reading fromthe dual port digital memory 10-3-3. Writing takes places continuouslysince the ADC is continuously sampling and digitizing RF signals and thefirst DSP (10-3-1A and 10-3-1B) is continuously performing the digitaldrop receiver function. However, reading occurs in bursts as theWireless Location System requests data for performing demodulation andlocation processing. The Wireless Location System may even performlocation processing recursively on a single transmission, and thereforerequires access to the same data multiple times. In order to service themany requirements of the Wireless Location System, the address generatorallows the dual port digital memory to be read at a rate faster than thewriting occurs. Typically, reading can be performed eight times fasterthan writing.

The DSP module 10-3 uses the second DSP 10-3-4 to read the data from thedigital memory 10-3-3, and then performs a second digital drop receiverfunction to extract baseband data from the blocks of RF channels (stepS5). For example, the second DSP can extract any single 30 KHz AMPS orTDMA channel from any block of RF channels that have been digitized andstored in the memory. Likewise, the second DSP can extract any singleGSM channel. The second DSP is not required to extract a CDMA channel,since the channel bandwidth occupies the full bandwidth of the stored RFdata. The combination of the first DSP 10-3-1A, 10-3-1B and the secondDSP 10-3-4 allows the DSP module to select, store, and recover anysingle RF channel in a wireless communications system. A DSP moduletypically will store four blocks of channels. In a dual-mode AMPS/TDMAsystem, a single DSP module can continuously and simultaneously monitorup to 42 analog reverse control channels, up to 84 digital controlchannels, and also be tasked to monitor and locate any voice channeltransmission. A single SCS chassis will typically support up to threereceiver modules 10-2 (FIG. 2), to cover three sectors of two antennaseach, and up to nine DSP modules (three DSP modules per receiver permitsan entire 15 MHz bandwidth to be simultaneously stored into digitalmemory). Thus, the SCS 10 is a very modular system than can be easilyscaled to match any type of cell site configuration and processing load.

The DSP module 10-3 also performs other functions, including automaticdetection of active channels used in each sector (step S6), demodulation(step S7), and station based location processing (step S8). The WirelessLocation System maintains an active map of the usage of the RF channelsin a wireless communications system (step S9), which enables theWireless Location System to manage receiver and processing resources,and to rapidly initiate processing when a particular transmission ofinterest has occurred. The active map comprises a table maintainedwithin the Wireless Location System that lists for each antennaconnected to an SCS 10 the primary channels assigned to that SCS 10 andthe protocols used in those channels. A primary channel is an RF controlchannel assigned to a collocated or nearby base station which the basestation uses for communications with wireless transmitters. For example,in a typical cellular system with sectored cell sites, there will be oneRF control channel frequency assigned for use in each sector. Thosecontrol channel frequencies would typically be assigned as primarychannels for a collocated SCS 10.

The same SCS 10 may also be assigned to monitor the RF control channelsof other nearby base stations as primary channels, even if other SCS's10 also have the same primary channels assigned. In this manner, theWireless Location System implements a system demodulation redundancythat ensures that any given wireless transmission has an infinitesimalprobability of being missed. When this demodulation redundancy featureis used, the Wireless Location System will receive, detect, anddemodulate the same wireless transmission two or more times at more thanone SCS 10. The Wireless Location System includes means to detect whenthis multiple demodulation has occurred and to trigger locationprocessing only once. This function conserves the processing andcommunications resources of the Wireless Location System, and is furtherdescribed below. This ability for a single SCS 10 to detect anddemodulate wireless transmissions occurring at cell sites not collocatedwith the SCS 10 permits operators of the Wireless Location System todeploy more efficient Wireless Location System networks. For example,the Wireless Location System may be designed such that the WirelessLocation System uses much fewer SCS's 10 than the wirelesscommunications system has base stations.

In the Wireless Location System, primary channels are entered andmaintained in the table using two methods: direct programming andautomatic detection. Direct programming comprises entering primarychannel data into the table using one of the Wireless Location Systemuser interfaces, such as the Network Operations Console 16 (FIG. 1), orby receiving channel assignment data from the Wireless Location Systemto wireless communications system interface. Alternatively, the DSPmodule 10-3 also runs a background process known as automatic detectionin which the DSP uses spare or scheduled processing capacity to detecttransmissions on various possible RF channels and then attempt todemodulate those transmissions using probable protocols. The DSP modulecan then confirm that the primary channels directly programmed arecorrect, and can also quickly detect changes made to channels at basestation and send an alert to the operator of the Wireless LocationSystem.

The DSP module performs the following steps in automatic detection (seeFIG. 2E-1):

for each possible control and/or voice channel which may be used in thecoverage area of the SCS 10, peg counters are established (step S7-1);

at the start of a detection period, all peg counters are reset to zero(step S7-2);

each time that a transmission occurs in a specified RF channel, and thereceived power level is above a particular pre-set threshold, the pegcounter for that channel is incremented (step S7-3);

each time that a transmission occurs in a specified RF channel, and thereceived power level is above a second particular pre-set threshold, theDSP module attempts to demodulate a certain portion of the transmissionusing a first preferred protocol (step S7-4);

if the demodulation is successful, a second peg counter for that channelis incremented (step S7-5);

if the demodulation is unsuccessful, the DSP module attempts todemodulate a portion of the transmission using a second preferredprotocol (step S7-6);

if the demodulation is successful, a third peg counter for that channelis incremented (step S7-7);

at the end of a detection period, the Wireless Location System reads allpeg counters (step S7-8); and

the Wireless Location System automatically assigns primary channelsbased upon the peg counters (step S7-9).

The operator of the Wireless Location System can review the peg countersand the automatic assignment of primary channels and demodulationprotocols, and override any settings that were performed automatically.In addition, if more than two preferred protocols may be used by thewireless carrier, then the DSP module 10-3 can be downloaded withsoftware to detect the additional protocols. The architecture of the SCS10, based upon wideband receivers 10-2, DSP modules 10-3, anddownloadable software permits the Wireless Location System to supportmultiple demodulation protocols in a single system. There is asignificant cost advantage to supporting multiple protocols within thesingle system, as only a single SCS 10 is required at a cell site. Thisis in contrast to many base station architectures, which may requiredifferent transceiver modules for different modulation protocols. Forexample, while the SCS 10 could support AMPS, TDMA, and CDMAsimultaneously in the same SCS 10, there is no base station currentlyavailable that can support this functionality.

The ability to detect and demodulate multiple protocols also includesthe ability to independently detect the use of authentication inmessages transmitted over the certain air interface protocols. The useof authentication fields in wireless transmitters started to becomeprevalent within the last few years as a means to reduce the occurrenceof fraud in wireless communications systems. However, not all wirelesstransmitters have implemented authentication. When authentication isused, the protocol generally inserts an additional field into thetransmitted message. Frequently this field is inserted between theidentity of the wireless transmitter and the dialed digits in thetransmitted message. When demodulating a wireless transmission, theWireless Location System determines the number of fields in thetransmitted message, as well as the message type (i.e. registration,origination, page response, etc.). The Wireless Location Systemdemodulates all fields and if extra fields appear to be present, givingconsideration to the type of message transmitted, then the WirelessLocation System tests all fields for a trigger condition. For example,if the dialed digits “911” appear in the proper place in a field, andthe field is located either in its proper place without authenticationor its proper place with authentication, then the Wireless LocationSystem triggers normally. In this example, the digits “911” would berequired to appear in sequence as “911” or “*911”, with no other digitsbefore or after either sequence. This functionality reduces oreliminates a false trigger caused by the digits “911” appearing as partof an authentication field.

The support for multiple demodulation protocols is important for theWireless Location System to successfully operate because locationprocessing must be quickly triggered when a wireless caller has dialed“911”. The Wireless Location System can trigger location processingusing two methods: the Wireless Location System will independentlydemodulate control channel transmissions, and trigger locationprocessing using any number of criteria such as dialed digits, or theWireless Location System may receive triggers from an external sourcesuch as the carrier's wireless communications system. The presentinventors have found that independent demodulation by the SCS 10 resultsin the fastest time to trigger, as measured from the moment that awireless user presses the “SEND” or “TALK” (or similar) button on awireless transmitter.

Control and Communications Module 10-5

The control and communications module 10-5, depicted in FIG. 2F,includes data buffers 10-5-1, a controller 10-5-2, memory 10-5-3, a CPU10-5-4 and a T1/E1 communications chip 10-5-5. The module has many ofthe characteristics previously described in U.S. Pat. No. 5,608,410.Several enhancements have been added in the present embodiment. Forexample, the SCS 10 now includes an automatic remote reset capability,even if the CPU on the control and communications module ceases toexecute its programmed software. This capability can reduce theoperating costs of the Wireless Location System because technicians arenot required to travel to a cell site to reset an SCS 10 if it fails tooperate normally. The automatic remote reset circuit operates bymonitoring the communications interface between the SCS 10 and the TLP12 for a particular sequence of bits. This sequence of bits is asequence that does not occur during normal communications between theSCS 10 and the TLP 12. This sequence, for example, may consist of an allones pattern. The reset circuit operates independently of the CPU sothat even if the CPU has placed itself in a locked or othernon-operating status, the circuit can still achieve the reset of the SCS10 and return the CPU to an operating status.

This module now also has the ability to record and report a wide varietyof statistics and variables used in monitoring or diagnosing theperformance of the SCS 10. For example, the SCS 10 can monitor thepercent capacity usage of any DSP or other processor in the SCS 10, aswell as the communications interface between the SCS 10 and the TLP 12.These values are reported regularly to the AP 14 and the NOC 16, and areused to determine when additional processing and communicationsresources are required in the system. For example, alarm thresholds maybe set in the NOC to indicate to an operator if any resource isconsistently exceeding a preset threshold. The SCS 10 can also monitorthe number of times that transmissions have been successfullydemodulated, as well as the number of failures. This is useful inallowing operators to determine whether the signal thresholds fordemodulation have been set optimally.

This module, as well as the other modules, can also self-report itsidentity to the TLP 12. As described below, many SCS's 10 can beconnected to a single TLP 12. Typically, the communications betweenSCS's 10 and TLP's 12 is shared with the communications between basestations and MSC's. It is frequently difficult to quickly determineexactly which SCS's 10 have been assigned to particular circuits.Therefore, the SCS 10 contains a hard coded identity, which is recordedat the time of installation. This identity can be read and verified bythe TLP 12 to positively determine which SCS 10 has been assigned by acarrier to each of several different communications circuits.

The SCS to TLP communications supports a variety of messages, including:commands and responses, software download, status and heartbeat,parameter download, diagnostic, spectral data, phase data, primarychannel demodulation, and RF data. The communications protocol isdesigned to optimize Wireless Location System operation by minimizingthe protocol overhead and the protocol includes a message priorityscheme. Each message type is assigned a priority, and the SCS 10 and theTLP 12 will queue messages by priority such that a higher prioritymessage is sent before a lower priority message is sent. For example,demodulation messages are generally set at a high priority because theWireless Location System must trigger location processing on certaintypes of calls (i.e., E9-1-1) without delay. Although higher prioritymessages are queued before lower priority messages, the protocolgenerally does not preempt a message that is already in transit. Thatis, a message in the process of being sent across the SCS 10 to TLP 12communications interface will be completed fully, but then the nextmessage to be sent will be the highest priority message with theearliest time stamp. In order to minimize the latency of high prioritymessages, long messages, such as RF data, are sent in segments. Forexample, the RF data for a full 100-millisecond AMPS transmission may beseparated into 10-millisecond segments. In this manner, a high prioritymessage may be queued in between segments of the RF data.

Calibration and Performance Monitoring

The architecture of the SCS 10 is heavily based upon digitaltechnologies including the digital receiver and the digital signalprocessors. Once RF signals have been digitized, timing, frequency, andphase differences can be carefully controlled in the various processes.More importantly, any timing, frequency, and phase differences can beperfectly matched between the various receivers and various SCS's 10used in the Wireless Location System. However, prior to the ADC, the RFsignals pass through a number of RF components, including antennas,cables, low noise amplifiers, filters, duplexors, multi-couplers, and RFsplitters. Each of these RF components has characteristics important tothe Wireless Location System, including delay and phase versus frequencyresponse. When the RF and analog components are perfectly matchedbetween the pairs of SCS's 10, such as SCS 10A and SCS 10B in FIG. 2G,then the effects of these characteristics are automatically eliminatedin the location processing. But when the characteristics of thecomponents are not matched, then the location processing caninadvertently include instrumental errors resulting from the mismatch.Additionally, many of these RF components can experience instabilitywith power, time, temperature, or other factors that can addinstrumental errors to the determination of location. Therefore, severalinventive techniques have been developed to calibrate the RF componentsin the Wireless Location System and to monitor the performance of theWireless Location System on a regular basis. Subsequent to calibration,the Wireless Location System stores the values of these delays andphases versus frequency response (i.e. by RF channel number) in a tablein the Wireless Location System for use in correcting these instrumentalerrors. FIGS. 2G-2J are referred to below in explaining thesecalibration methods.

External Calibration Method

Referring to FIG. 2G, the timing stability of the Wireless LocationSystem is measured along baselines, wherein each baseline is comprisedof two SCS's, 10A and 10B, and an imaginary line (A-B) drawn betweenthem. In a TDOA/FDOA type of Wireless Location System, locations ofwireless transmitters are calculated by measuring the differences in thetimes that each SCS 10 records for the arrival of the signal from awireless transmitter. Thus, it is important that the differences intimes measured by SCS's 10 along any baseline are largely attributed tothe transmission time of the signal from the wireless transmitter andminimally attributed to the variations in the RF and analog componentsof the SCS's 10 themselves. To meet the accuracy goals of the WirelessLocation System, the timing stability for any pair of SCS's 10 aremaintained at much less than 100 nanoseconds RMS (root mean square).Thus, the components of the Wireless Location System will contributeless than 100 feet RMS of instrumentation error in the estimation of thelocation of a wireless transmitter. Some of this error is allocated tothe ambiguity of the signal used to calibrate the system. This ambiguitycan be determined from the well-known Cramer-Rao lower bound equation.In the case of an AMPS reverse control channel, this error isapproximately 40 nanoseconds RMS. The remainder of the error budget isallocated to the components of the Wireless Location System, primarilythe RF and analog components in the SCS 10.

In the external calibration method, the Wireless Location System uses anetwork of calibration transmitters whose signal characteristics matchthose of the target wireless transmitters. These calibrationtransmitters may be ordinary wireless telephones emitting periodicregistration signals and/or page response signals. Each usableSCS-to-SCS baseline is preferably calibrated periodically using acalibration transmitter that has a relatively clear and unobstructedpath to both SCS's 10 associated with the baseline. The calibrationsignal is processed identically to a signal from a target wirelesstransmitter. Since the TDOA values are known a priori, any errors in thecalculations are due to systemic errors in the Wireless Location System.These systemic errors can then be removed in the subsequent locationcalculations for target transmitters.

FIG. 2G illustrates the external calibration method for minimizingtiming errors. As shown, a first SCS 10A at a point “A” and a second SCS10A at a point “B” have an associated baseline A-B. A calibration signalemitted at time T₀ by a calibration transmitter at point “C” willtheoretically reach first SCS 10A at time T₀+T_(AC). T_(AC) is a measureof the amount of time required for the calibration signal to travel fromthe antenna on the calibration transmitter to the dual port digitalmemory in a digital receiver. Likewise, the same calibration signal willreach second SCS 10B at a theoretical time T₀+T_(BC). Usually, however,the calibration signal will not reach the digital memory and the digitalsignal processing components of the respective SCS's 10 at exactly thecorrect times. Rather, there will be errors e1 and e2 in the amount oftime (T_(AC), T_(BC)) it takes the calibration signal to propagate fromthe calibration transmitter to the SCS's 10, respectively, such that theexact times of arrival are actually T₀+T_(AC)+e1 and T₀+T_(BC)+e2. Sucherrors will be due to some extent to delays in the signal propagationthrough the air, i.e., from the calibration transmitter's antenna to theSCS antennas; however, the errors will be due primarily to time varyingcharacteristics in the SCS front end components. The errors e1 and e2cannot be determined per se because the system does not know the exacttime (T₀) at which the calibration signal was transmitted. The systemcan, however, determine the error in the difference in the time ofarrival of the calibration signal at the respective SCS's 10 of anygiven pair of SCS's 10. This TDOA error value is defined as thedifference between the measured TDOA value and the theoretical TDOAvalue τ₀, wherein τ₀ is the theoretical differences between thetheoretical delay values T_(AC) and T_(BC). Theoretical TDOA values foreach pair of SCS's 10 and each calibration transmitter are known becausethe positions of the SCS's 10 and calibration transmitter, and the speedat which the calibration signal propagates, are known. The measured TDOAbaseline (TDOA_(A-B)) can be represented as TDOA_(A-B)=τ₀+∈, wherein∈=e1−e2. In a similar manner, a calibration signal from a secondcalibration transmitter at point “D” will have associated errors e3 ande4. The ultimate value of ∈ to be subtracted from TDOA measurements fora target transmitter will be a function (e.g., weighted average) of the∈ values derived for one or more calibration transmitters. Therefore, agiven TDOA measurement (TDOA_(measured)) for a pair of SCS's 10 atpoints “X” and “Y” and a target wireless transmitter at an unknownlocation will be corrected as follows:

TDOA _(X-Y) =TDOA _(measured)−∈

∈=k 1∈1 +k 2∈2+ . . . kN∈N,

where k1, k2, etc., are weighting factors and ∈1, ∈2, etc., are theerrors determined by subtracting the measured TDOA values from thetheoretical values for each calibration transmitter. In this example,error value ∈1 may the error value associated with the calibrationtransmitter at point “C” in the drawing. The weighting factors aredetermined by the operator of the Wireless Location System, and inputinto the configuration tables for each baseline. The operator will takeinto consideration the distance from each calibration transmitter to theSCS's 10 at points “X” and “Y”, the empirically determined line of sightfrom each calibration transmitter to the SC S's 10 at points “X” and“Y”, and the contribution that each SCS “X” and “Y” would have made to alocation estimate of a wireless transmitter that might be located in thevicinity of each calibration transmitter. In general, calibrationtransmitters that are nearer to the SCS's 10 at points “X” and “Y” willbe weighted higher than calibration transmitters that are farther away,and calibration transmitters with better line of sight to the SCS's 10at points “X” and “Y” will be weighted higher than calibrationtransmitters with worse line of sight.

Each error component e1, e2, etc., and therefore the resulting errorcomponent ∈, can vary widely, and wildly, over time because some of theerror component is due to multipath reflection from the calibrationtransmitter to each SCS 10. The multipath reflection is very much pathdependent and therefore will vary from measurement to measurement andfrom path to path. It is not an object of this method to determine themultipath reflection for these calibration paths, but rather todetermine the portion of the errors that are attributable to thecomponents of the SCS's 10. Typically, therefore, error values e1 and e3will have a common component since they relate to the same first SCS10A. Likewise, error values e2 and e4 will also have a common componentsince they relate to the second SCS 10B. It is known that while themultipath components can vary wildly, the component errors vary slowlyand typically vary sinusoidally. Therefore, in the external calibrationmethod, the error values ∈ are filtered using a weighted, time-basedfilter that decreases the weight of the wildly varying multipathcomponents while preserving the relatively slow changing errorcomponents attributed to the SCS's 10. One such exemplary filter used inthe external calibration method is the Kalman filter.

The period between calibration transmissions is varied depending on theerror drift rates determined for the SCS components. The period of thedrift rate should be much longer than the period of the calibrationinterval. The Wireless Location System monitors the period of the driftrate to determine continuously the rate of change, and may periodicallyadjust the calibration interval, if needed. Typically, the calibrationrate for a Wireless Location System such as one in accordance with thepresent invention is between 10 and 30 minutes. This corresponds wellwith the typical time period for the registration rate in a wirelesscommunications system. If the Wireless Location System were to determinethat the calibration interval must be adjusted to a rate faster than theregistration rate of the wireless communications system, then the AP 14(FIG. 1) would automatically force the calibration transmitter totransmit by paging the transmitter at the prescribed interval. Eachcalibration transmitter is individually addressable and therefore thecalibration interval associated with each calibration transmitter can bedifferent.

Since the calibration transmitters used in the external calibrationmethod are standard telephones, the Wireless Location System must have amechanism to distinguish those telephones from the other wirelesstransmitters that are being located for various application purposes.The Wireless Location System maintains a list of the identities of thecalibration transmitters, typically in the TLP 12 and in the AP 14. In acellular system, the identity of the calibration transmitter can be theMobile Identity Number, or MIN. When the calibration transmitter makes atransmission, the transmission is received by each SCS 10 anddemodulated by the appropriate SCS 10. The Wireless Location Systemcompares the identity of the transmission with a pre-stored tasking listof identities of all calibration transmitters. If the Wireless LocationSystem determines that the transmission was a calibration transmission,then the Wireless Location System initiates external calibrationprocessing.

Internal Calibration Method

In addition to the external calibration method, it is an object of thepresent invention to calibrate all channels of the wideband digitalreceiver used in the SCS 10 of a Wireless Location System. The externalcalibration method will typically calibrate only a single channel of themultiple channels used by the wideband digital receiver. This is becausethe fixed calibration transmitters will typically scan to thehighest-power control channel, which will typically be the same controlchannel each time. The transfer function of a wideband digital receiver,along with the other associated components, does not remain perfectlyconstant, however, and will vary with time and temperature. Therefore,even though the external calibration method can successfully calibrate asingle channel, there is no assurance that the remaining channels willalso be calibrated.

The internal calibration method, represented in the flowchart of FIG.2H, is particularly suited for calibrating an individual first receiversystem (i.e., SCS 10) that is characterized by a time- andfrequency-varying transfer function, wherein the transfer functiondefines how the amplitude and phase of a received signal will be alteredby the receiver system and the receiver system is utilized in a locationsystem to determine the location of a wireless transmitter by, in part,determining a difference in time of arrival of a signal transmitted bythe wireless transmitter and received by the receiver system to becalibrated and another receiver system, and wherein the accuracy of thelocation estimate is dependent, in part, upon the accuracy of TDOAmeasurements made by the system. An example of a AMPS RCC transferfunction is depicted in FIG. 21, which depicts how the phase of thetransfer function varies across the 21 control channels spanning 630KHz.

Referring to FIG. 2H, the internal calibration method includes the stepsof temporarily and electronically disconnecting the antenna used by areceiver system from the receiver system (step S-20); injecting aninternally generated wideband signal with known and stable signalcharacteristics into the first receiver system (step S-21); utilizingthe generated wideband signal to obtain an estimate of the manner inwhich the transfer function varies across the bandwidth of the firstreceiver system (step S-22); and utilizing the estimate to mitigate theeffects of the variation of the first transfer function on the time andfrequency measurements made by the first receiver system (step S-23).One example of a stable wideband signal used for internal calibration isa comb signal, which is comprised of multiple individual,equal-amplitude frequency elements at a known spacing, such as 5 KHz. Anexample of such a signal is shown in FIG. 21.

The antenna must be temporarily disconnected during the internalcalibration process to prevent external signals from entering thewideband receiver and to guarantee that the receiver is only receivingthe stable wideband signal. The antenna is electronically disconnectedonly for a few milliseconds to minimize the chance of missing too muchof a signal from a wireless transmitter. In addition, internalcalibration is typically performed immediately after externalcalibration to minimize the possibility that the any component in theSCS 10 drifts during the interval between external and internalcalibration. The antenna is disconnected from the wideband receiverusing two electronically controlled RF relays (not shown). An RF relaycannot provide perfect isolation between input and output even when inthe “off” position, but it can provide up to 70 dB of isolation. Tworelays may be used in series to increase the amount of isolation and tofurther assure that no signal is leaked from the antenna to the widebandreceiver during calibration. Similarly, when the internal calibrationfunction is not being used, the internal calibration signal is turnedoff, and the two RF relays are also turned off to prevent leakage of theinternal calibration signals into the wideband receiver when thereceiver is collecting signals from wireless transmitters.

The external calibration method provides an absolute calibration of asingle channel and the internal calibration method then calibrates eachother channel relative to the channel that had been absolutelycalibrated. The comb signal is particularly suited as a stable widebandsignal because it can be easily generated using a stored replica of thesignal and a digital to analog converter.

External Calibration Using Wideband Calibration Signal

The external calibration method described next may be used in connectionwith an SCS 10 receiver system characterized by a time- andfrequency-varying transfer function, which preferably includes theantennas, filters, amplifiers, duplexors, multi-couplers, splitters, andcabling associated with the SCS receiver system. The method includes thestep of transmitting a stable, known wideband calibration signal from anexternal transmitter. The wideband calibration signal is then used toestimate the transfer function across a prescribed bandwidth of the SCSreceiver system. The estimate of the transfer function is subsequentlyemployed to mitigate the effects of variation of the transfer functionon subsequent TDOA/FDOA measurements. The external transmission ispreferably of short duration and low power to avoid interference withthe wireless communications system hosting the Wireless Location System.

In the preferred method, the SCS receiver system is synchronized withthe external transmitter. Such synchronization may be performed usingGPS timing units. Moreover, the receiver system may be programmed toreceive and process the entire wideband of the calibration signal onlyat the time that the calibration signal is being sent. The receiversystem will not perform calibration processing at any time other thanwhen in synchronization with the external calibration transmissions. Inaddition, a wireless communications link is used between the receiversystem and the external calibration transmitter to exchange commands andresponses. The external transmitter may use a directional antenna todirect the wideband signal only at the antennas of the SCS receiversystem. Such as directional antenna may be a Yagi antenna (i.e. linearend-fire array). The calibration method preferably includes making theexternal transmission only when the directional antenna is aimed at thereceiver system's antennas and the risk of multipath reflection is low.

Calibrating for Station Biases

Another aspect of the present invention concerns a calibration method tocorrect for station biases in a SCS receiver system. The “station bias”is defined as the finite delay between when an RF signal from a wirelesstransmitter reaches the antenna and when that same signal reached thewideband receiver. The inventive method includes the step of measuringthe length of the cable from the antennas to the filters and determiningthe corresponding delays associated with the cable length. In addition,the method includes injecting a known signal into the filter, duplexor,multi-coupler, or RF splitter and measuring the delay and phase responseversus frequency response from the input of each device to the widebandreceiver. The delay and phase values are then combined and used tocorrect subsequent location measurements. When used with the GPS basedtiming generation described above, the method preferably includescorrecting for the GPS cable lengths. Moreover, an externally generatedreference signal is preferably used to monitor changes in station biasthat may arise due to aging and weather. Finally, the station bias by RFchannel and for each receiver system in the Wireless Location System ispreferably stored in tabular form in the Wireless Location System foruse in correcting subsequent location processing.

Performance Monitoring

The Wireless Location System uses methods similar to calibration forperformance monitoring on a regular and ongoing basis. These methods aredepicted in the flowcharts of FIGS. 2K and 2L. Two methods ofperformance monitoring are used: fixed phones and drive testing ofsurveyed points. The fixed phone method comprises the following steps(see FIG. 2K):

standard wireless transmitters are permanently placed at various pointswithin the coverage area of the Wireless Location System (these are thenknown as the fixed phones) (step S-30);

the points at which the fixed phones have been placed are surveyed sothat their location is precisely known to within a predetermineddistance, for example ten feet (step S-31);

the surveyed locations are stored in a table in the AP 14 (step S-32);

the fixed phones are permitted to register on the wirelesscommunications system, at the rate and interval set by the wirelesscommunications system for all wireless transmitters on the system (stepS-33);

at each registration transmission by a fixed phone, the WirelessLocation System locates the fixed phone using normal location processing(as with the calibration transmitters, the Wireless Location System canidentify a transmission as being from a fixed phone by storing theidentities in a table) (step S-34);

the Wireless Location System computes an error between the calculatedlocation determined by the location processing and the stored locationdetermined by survey (step S-35);

the location, the error value, and other measured parameters are storedalong with a time stamp in a database in the AP 14 (step S-36);

the AP 14 monitors the instant error and other measured parameters(collectively referred to as an extended location record) andadditionally computes various statistical values of the error(s) andother measured parameters (step S-37); and

if any of the error or other values exceed a pre-determined threshold ora historical statistical value, either instantaneously or afterperforming statistical filtering over a prescribed number of locationestimates, the AP 14 signals an alarm to the operator of the WirelessLocation System (step S-38).

The extended location record includes a large number of measuredparameters usefully for analyzing the instant and historical performanceof the Wireless Location System. These parameters include: the RFchannel used by the wireless transmitter, the antenna port(s) used bythe Wireless Location System to demodulate the wireless transmission,the antenna ports from which the Wireless Location System requested RFdata, the peak, average, and variance in power of the transmission overthe interval used for location processing, the SCS 10 and antenna portchosen as the reference for location processing, the correlation valuefrom the cross-spectra correlation between every other SCS 10 andantenna used in location processing and the reference SCS 10 andantenna, the delay value for each baseline, the multipath mitigationparameters, and the residual values remaining after the multipathmitigation calculations. Any of these measured parameters can bemonitored by the Wireless Location System for the purpose of determininghow the Wireless Location System is performing. One example of the typeof monitoring performed by the Wireless Location System may be thevariance between the instant value of the correlation on a baseline andthe historical range of the correlation value. Another may be thevariance between the instant value of the received power at a particularantenna and the historical range of the received power. Many otherstatistical values can be calculated and this list is not exhaustive.

The number of fixed phones placed into the coverage area of the WirelessLocation System can be determined based upon the density of the cellsites, the difficulty of the terrain, and the historical ease with whichwireless communications systems have performed in the area. Typicallythe ratio is about one fixed phone for every six cell sites, however insome areas a ratio of one to one may be required. The fixed phonesprovide a continuous means to monitor the performance of the WirelessLocation System, as well as the monitor any changes in the frequencyplan that the carrier may have made. Many times, changes in thefrequency plan will cause a variation in the performance of the WirelessLocation System and the performance monitoring of the fixed phonesprovide an immediate indication to the Wireless Location Systemoperator.

Drive testing of surveyed points is very similar to the fixed phonemonitoring. Fixed phones typically can only be located indoors whereaccess to power is available (i.e. the phones must be continuouslypowered on to be effective). To obtain a more complete measurement ofthe performance of the location performance, drive testing of outdoortest points is also performed. Referring to FIG. 2L, as with the fixedphones, prescribed test points throughout the coverage area of theWireless Location System are surveyed to within ten feet (step S-40).Each test point is assigned a code, wherein the code consists of eithera “*” or a “#”, followed by a sequence number (step S-41). For example,“*1001” through “*1099” may be a sequence of 99 codes used for testpoints. These codes should be sequences, that when dialed, aremeaningless to the wireless communications system (i.e. the codes do notcause a feature or other translation to occur in the MSC, except for anintercept message). The AP 14 stores the code for each test point alongwith the surveyed location (step S-42). Subsequent to these initialsteps, any wireless transmitter dialing any of the codes will betriggered and located using normal location processing (steps S-43 andS-44). The Wireless Location System automatically computes an errorbetween the calculated location determined by the location processingand the stored location determined by survey, and the location and theerror value are stored along with a time stamp in a database in the AP14 (steps S-45 and S-46). The AP 14 monitors the instant error, as wellas various historical statistical values of the error. If the errorvalues exceed a pre-determined threshold or a historical statisticalvalue, either instantaneously or after performing statistical filteringover a prescribed number of location estimates, the AP 14 signals analarm to the operator of the Wireless Location System (step S-47).

TDOA Location Processor (TLP)

The TLP 12, depicted in FIGS. 1, 1A and 3, is a centralized digitalsignal processing system that manages many aspects of the WirelessLocation System, especially the SCS's 10, and provides control over thelocation processing. Because location processing is DSP intensive, oneof the major advantages of the TLP 12 is that the DSP resources can beshared among location processing initiated by transmissions at any ofthe SCS's 10 in a Wireless Location System. That is, the additional costof DSP's at the SCS's 10 is reduced by having the resource centrallyavailable. As shown in FIG. 3, there are three major components of theTLP 12: DSP modules 12-1, T1/E1 communications modules 12-2 and acontroller module 12-3. The T1/E1 communications modules 12-2 providethe communications interface to the SCS's 10 (T1 and E1 are standardcommunications speeds available throughout the world). Each SCS 10communicates to a TLP 12 using one or more DSO's (which are typically 56Kbps or 64 Kbps). Each SCS 10 typically connects to a fractional T1 orE1 circuit, using, e.g., a drop and insert unit or channel bank at thecell site. Frequently, this circuit is shared with the base station,which communicates with the MSC. At a central site, the DSO's assignedto the base station are separated from the DSO's assigned to the SCS's10. This is typically accomplished external to the TLP 12 using adigital access and control system (DACS) 13A that not only separates theDS0's but also grooms the DS0's from multiple SCS's 10 onto full T1 orE1 circuits. These circuits then connect from the DACS 13A to the DACS13B and then to the T1/E1 communications module on the TLP 12. EachT1/E1 communications module contains sufficient digital memory to bufferpackets of data to and from each SCS 10 communicating with the module. Asingle TLP chassis may support one or more T1/E1 communications modules.

The DSP modules 12-1 provide a pooled resource for location processing.A single module may typically contain two to eight digital signalprocessors, each of which are equally available for location processing.Two types of location processing are supported: central based andstation based, which are described in further detail below. The TLPcontroller 12-3 manages the DSP module(s) 12-1 to obtain optimalthroughput. Each DSP module contains sufficient digital memory to storeall of the data necessary for location processing. A DSP is not engageduntil all of the data necessary to begin location processing has beenmoved from each of the involved SCS's 10 to the digital memory on theDSP module. Only then is a DSP given the specific task to locate aspecific wireless transmitter. Using this technique, the DSP's, whichare an expensive resource, are never kept waiting. A single TLP chassismay support one or more DSP modules.

The controller module 12-3 provides the real time management of alllocation processing within the Wireless Location System. The AP 14 isthe top-level management entity within the Wireless Location System,however its database architecture is not sufficiently fast to conductthe real time decision making when transmissions occur. The controllermodule 12-3 receives messages from the SCS's 10, including: status,spectral energy in various channels for various antennas, demodulatedmessages, and diagnostics. This enables the controller to continuouslydetermine events occurring in the Wireless Location System, as well asto send commands to take certain actions. When a controller modulereceives demodulated messages from SCS's 10, the controller moduledecides whether location processing is required for a particularwireless transmission. The controller module 12-3 also determines whichSCS's 10 and antennas to use in location processing, including whetherto use central based or station based location processing. Thecontroller module commands SCS's 10 to return the necessary data, andcommands the communications modules and DSP modules to sequentiallyperform their necessary roles in location processing. These steps aredescribed below in further detail.

The controller module 12-3 maintains a table known as the Signal ofInterest Table (SOIT). This table contains all of the criteria that maybe used to trigger location processing on a particular wirelesstransmission. The criteria may include, for example, the Mobile IdentityNumber, the Mobile Station ID, the Electronic Serial Number, dialeddigits, System ID, RF channel number, cell site number or sector number,type of transmission, and other types of data elements. Some of thetrigger events may have higher or lower priority levels associated withthem for use in determining the order of processing. Higher prioritylocation triggers will always be processing before lower prioritylocation triggers. However, a lower priority trigger that has alreadybegun location processing will complete the processing before beingassigned to a higher priority task. The master Tasking List for theWireless Location System is maintained on the AP 14, and copies of theTasking List are automatically downloaded to the Signal of InterestTable in each TLP 12 in the Wireless Location System. The fall Signal ofInterest Table is downloaded to a TLP 12 when the TLP 12 is reset orfirst starts. Subsequent to those two events, only changes aredownloaded from the AP 14 to each TLP 12 to conserve communicationsbandwidth. The TLP 12 to AP 14 communications protocol preferablycontains sufficient redundancy and error checking to prevent incorrectdata from ever being entered into the Signal of Interest Table. When theAP 14 and TLP 12 periodically have spare processing capacity available,the AP 14 reconfirms entries in the Signal of Interest Table to ensurethat all Signal of Interest Table entries in the Wireless LocationSystem are in full synchronization.

Each TLP chassis has a maximum capacity associated with the chassis. Forexample, a single TLP chassis may only have sufficient capacity tosupport between 48 and 60 SCS's 10. When a wireless communicationssystem is larger that the capacity of a single TLP chassis, multiple TLPchassis are connected together using Ethernet networking. The controllermodule 12-3 is responsible for inter-TLP communications and networking,and communicates with the controller modules in other TLP chassis andwith Application Processors 14 over the Ethernet network. Inter-TLPcommunications is required when location processing requires the use ofSCS's 10 that are connected to different TLP chassis. Locationprocessing for each wireless transmission is assigned to a single DSPmodule in a single TLP chassis. The controller modules 12-3 in TLPchassis select the DSP module on which to perform location processing,and then route all of the RF data used in location processing to thatDSP module. If RF data is required from the SCS's 10 connected to morethat one TLP 12, then the controller modules in all necessary TLPchassis communicate to move the RF data from all necessary SCS's 10 totheir respective connected TLP's 12 and then to the DSP module and TLPchassis assigned to the location processing. The controller modulesupports two fully independent Ethernet networks for redundancy. A breakor failure in any one network causes the affected TLP's 12 toimmediately shift all communications to the other network.

The controller modules 12-3 maintain a complete network map of theWireless Location System, including the SCS's 10 associated with eachTLP chassis. The network map is a table stored in the controller modulecontaining a list of the candidate SCS/antennas that may be used inlocation processing, and various parameters associated with each of theSCS/antennas. The structure of an exemplary network map is depicted inFIG. 3A. There is a separate entry in the table for each antennaconnected to an SCS 10. When a wireless transmission occurs in an areathat is covered by SCS's 10 communicating with more than one TLPchassis, the controller modules in the involved TLP chassis determinewhich TLP chassis will be the “master” TLP chassis for the purpose ofmanaging location processing. Typically, the TLP chassis associated withthe SCS 10 that has the primary channel assignment for the wirelesstransmission is assigned to be the master. However, another TLP chassismay be assigned instead if that TLP temporarily has no DSP resourcesavailable for location processing, or if most of the SCS's 10 involvedin location processing are connected to another TLP chassis and thecontroller modules are minimizing inter-TLP communications. Thisdecision making process is fully dynamic, but is assisted by tables inthe TLP 12 that pre-determine the preferred TLP chassis for everyprimary channel assignment. The tables are created by the operator ofthe Wireless Location System, and programmed using the NetworkOperations Console.

The networking described herein functions for both TLP chassisassociated with the same wireless carrier, as well as for chassis thatoverlap or border the coverage area between two wireless carriers. Thusit is possible for a TLP 12 belonging to a first wireless carrier to benetworked and therefore receive RF data from a TLP 12 (and the SCS's 10associated with that TLP 12) belonging to a second wireless carrier.This networking is particularly valuable in rural areas, wherein theperformance of the Wireless Location System can be enhanced by deployingSCS's 10 at cell sites of multiple wireless carriers. Since in manycases wireless carriers do not colocate cell sites, this feature enablesthe Wireless Location System to access more geographically diverseantennas than might be available if the Wireless Location System usedonly the cell sites from a single wireless carrier. As described below,the proper selection and use of antennas for location processing canenhance the performance of the Wireless Location System.

The controller module 12-3 passes many messages, including locationrecords, to the AP 14, many of which are described below. Usually,however, demodulated data is not passed from the TLP 12 to the AP 14.If, however, the TLP 12 receives demodulated data from a particularwireless transmitter and the TLP 12 identifies the wireless transmitteras being a registered customer of a second wireless carrier in adifferent coverage area, the TLP 12 may pass the demodulated data to thefirst (serving) AP 14A. This will enable the first AP 14A to communicatewith a second AP 14B associated with the second wireless carrier, anddetermine whether the particular wireless transmitter has registered forany type of location services. If so, the second AP 14B may instruct thefirst AP 14A to place the identity of the particular wirelesstransmitter into the Signal of Interest Table so that the particularwireless transmitter will be located for as long as the particularwireless transmitter is in the coverage area of the first WirelessLocation System associated with the first AP 14A. When the firstWireless Location System has detected that the particular wirelesstransmitter has not registered in a time period exceeding apre-determined threshold, the first AP 14A may instruct the second AP14B that the identity of the particular wireless transmitter is beingremoved from the Signal of Interest Table for the reason of no longerbeing present in the coverage area associated with the first AP 14A.

Diagnostic Port

The TLP 12 supports a diagnostic port that is highly useful in theoperation and diagnosis of problems within the Wireless Location System.This diagnostic port can be accessed either locally at a TLP 12 orremotely over the Ethernet network connecting the TLP's 12 to the AP's.The diagnostic port enables an operator to write to a file all of thedemodulation and RF data received from the SCS's 10, as well as theintermediate and final results of all location processing. This data iserased from the TLP 12 after processing a location estimate, andtherefore the diagnostic port provides the means to save the data forlater post-processing and analysis. The inventor's experience inoperating large scale wireless location systems is that a very smallnumber of location estimates can occasionally have very large errors,and these large errors can dominate the overall operating statistics ofthe Wireless Location System over any measurement period. Therefore, itis important to provide the operator with a set of tools that enable theWireless Location System to detect and trap the cause of the very largeerrors to diagnose and mitigate those errors. The diagnostic port can beset to save the above information for all location estimates, forlocation estimates from particular wireless transmitters or atparticular test points, or for location estimates that meet a certaincriteria. For example, for fixed phones or drive testing of surveyedpoints, the diagnostic port can determine the error in the locationestimate in real time and then write the above described informationonly for those location estimates whose error exceeds a predeterminedthreshold. The diagnostic port determines the error in real time bystoring the surveyed latitude, longitude coordinate of each fixed phoneand drive test point in a table, and then calculating a radial errorwhen a location estimate for the corresponding test point is made.

Redundancy

The TLP's 12 implement redundancy using several inventive techniques,allowing the Wireless Location System to support an M plus N redundancymethod. M plus N redundancy means that N redundant (or standby) TLPchassis are used to provide full redundant backup to M online TLPchassis. For example, M may be ten and N may be two.

First, the controller modules in different TLP chassis continuouslyexchange status and “heartbeat” messages at predetermined time intervalsbetween themselves and with every AP 14 assigned to monitor the TLPchassis. Thus, every controller module has continuous and full status ofevery other controller module in the Wireless Location System. Thecontroller modules in different TLP chassis periodically select onecontroller module in one TLP 12 to be the master controller for a groupof TLP chassis. The master controller may decide to place a first TLPchassis into off-line status if the first TLP 12A reports a failed ordegraded condition in its status message, or if the first TLP 12A failsto report any status or heartbeat messages within its assigned andpre-determined time. If the master controller places a first TLP 12Ainto off-line status, the master controller may assign a second TLP 12Bto perform a redundant switchover and assume the tasks of the off-linefirst TLP 12A. The second TLP 12B is automatically sent theconfiguration that had been loaded into the first TLP 12A; thisconfiguration may be downloaded from either the master controller orfrom an AP 14 connected to the TLP's 12. The master controller may be acontroller module on any one of the TLP's 12 that is not in off-linestatus, however there is a preference that the master controller be acontroller module in a stand-by TLP 12. When the master controller isthe controller module in a stand-by TLP 12, the time required to detecta failed first TLP 12A, place the first TLP 12A into off-line status,and then perform a redundant switchover can be accelerated.

Second, all of the T1 or E1 communications between the SCS's 10 and eachof the TLP T1/E1 communications modules 12-2 are preferably routedthrough a high-reliability DACS that is dedicated to redundancy control.The DACS 13B is connected to every groomed T1/E1 circuit containingDSO's from SCS's 10 and is also connected to every T1/E1 communicationsmodule 12-2 of every TLP 12. Every controller module at every TLP 12contains a map of the DACS 13B that describes the DACS' connection listand port assignments. This DACS 13B is connected to the Ethernet networkdescribed above and can be controlled by any of the controller modules12-3 at any of the TLP's 12. When a second TLP 12 is placed intooff-line status by a master controller, the master controller sendscommands to the DACS 13B to switch the groomed T1/E1 circuitcommunicating with the first TLP 12A to a second TLP 12B which had beenin standby status. At the same time, the AP 14 downloads the completeconfiguration file that was being used by the second (and now off-line)TLP 12B to the third (and now online) TLP 12C. The time from the firstdetection of a failed first TLP chassis to the complete switch-over andassumption of processing responsibilities by a third TLP chassis istypically less than few seconds. In many cases, no RF data is lost bythe SCS's 10 associated with the failed first TLP chassis, and locationprocessing can continue without interruption. At the time of a TLPfail-over when a first TLP 12A is placed into off-line status, the NOC16 creates an alert to notify the Wireless Location System operator thatthe event has occurred.

Third, each TLP chassis contains redundant power supplies, fans, andother components. A TLP chassis can also support multiple DSP modules,so that the failure of a single DSP module or even a single DSP on a DSPmodule reduces the overall amount of processing resources available butdoes not cause the failure of the TLP chassis. In all of the casesdescribed in this paragraph, the failed component of the TLP 12 can bereplaced without placing the entire TLP chassis into off-line status.For example, if a single power supply fails, the redundant power supplyhas sufficient capacity to singly support the load of the chassis. Thefailed power supply contains the necessary circuitry to remove itselffrom the load of the chassis and not cause further degradation in thechassis. Similarly, a failed DSP module can also remove itself from theactive portions of the chassis, so as to not cause a failure of thebackplane or other modules. This enables the remainder of the chassis,including the second DSP module, to continue to function normally. Ofcourse, the total processing throughput of the chassis is reduced but atotal failure is avoided.

Application Processor (AP) 14

The AP 14 is a centralized database system, comprising a number ofsoftware processes that manage the entire Wireless Location System,provide interfaces to external users and applications, store locationrecords and configurations, and support various application-relatedfunctionality. The AP 14 uses a commercial hardware platform that issized to match the throughput of the Wireless Location System. The AP 14also uses a commercial relational database system (RDBMS), which hasbeen significantly customized to provide the functionality describedherein. While the SCS 10 and TLP 12 preferably operate together on apurely real time basis to determine location and create locationrecords, the AP 14 can operate on both a real time basis to store andforward location records and a non-real time basis to post-processlocation records and provide access and reporting over time. The abilityto store, retrieve, and post-process location records for various typesof system and application analysis has proven to be a powerful advantageof the present invention. The main collection of software processes isknown as the ApCore, which is shown in FIG. 4 and includes the followingfunctions:

The AP Performance Guardian (ApPerfGuard) is a dedicated softwareprocess that is responsible for starting, stopping, and monitoring mostother ApCore processes as well as ApCore communications with the NOC 16.Upon receiving a configuration update command from the NOC, ApPerfGuardupdates the database and notifies all other processes of the change.ApPerfGuard starts and stops appropriate processes when the NOC directsthe ApCore to enter specific run states, and constantly monitors othersoftware processes scheduled to be running to restart them if they haveexited or stopping and restarting any process that is no longer properlyresponding. ApPerfGuard is assigned to one of the highest processingpriorities so that this process cannot be blocked by another processthat has “run away”. ApPerfGuard is also assigned dedicated memory thatis not accessible by other software processes to prevent any possiblecorruption from other software processes.

The AP Dispatcher (ApMnDsptch) is a software process that receiveslocation records from the TLP's 12 and forwards the location records toother processes. This process contains a separate thread for eachphysical TLP 12 configured in the system, and each thread receiveslocation records from that TLP 12. For system reliability, the ApCoremaintains a list containing the last location record sequence numberreceived from each TLP 12, and sends this sequence number to the TLP 12upon initial connection. Thereafter, the AP 14 and the TLP 12 maintain aprotocol whereby the TLP 12 sends each location record with a uniqueidentifier. ApMnDsptch forwards location records to multiple processes,including Ap911, ApDbSend, ApDbRecvLoc, and ApDbFileRecv.

The AP Tasking Process (ApDbSend) controls the Tasking List within theWireless Location System. The Tasking List is the master list of all ofthe trigger criteria that determines which wireless transmitters will belocated, which applications created the criteria, and which applicationscan receive location record information. The ApDbSend process contains aseparate thread for each TLP 12, over which the ApDbSend synchronizesthe Tasking List with the Signal of Interest Table on each TLP 12.ApDbSend does not send application information to the Signal of InterestTable, only the trigger criteria. Thus the TLP 12 does not know why awireless transmitter must be located. The Tasking List allows wirelesstransmitters to be located based upon Mobile Identity Number (MIN),Mobile Station Identifier (MSID), Electronic Serial Number (ESN) andother identity numbers, dialed sequences of characters and/or digits,home System ID (SID), originating cell site and sector, originating RFchannel, or message type. The Tasking List allows multiple applicationsto receive location records from the same wireless transmitter. Thus, asingle location record from a wireless transmitter that has dialed “911”can be sent, for example, to a 911 PSAP, a fleet management application,a traffic management application, and to an RF optimization application.

The Tasking List also contains a variety of flags and field for eachtrigger criteria, some of which are described elsewhere in thisspecification. One flag, for example, specifies the maximum time limitbefore which the Wireless Location System must provide a rough or finalestimate of the wireless transmitter. Another flag allows locationprocessing to be disabled for a particular trigger criteria such as theidentity of the wireless transmitter. Another field contains theauthentication required to make changes to the criteria for a particulartrigger; authentication enables the operator of the Wireless LocationSystem to specify which applications are authorized to add, delete, ormake changes to any trigger criteria and associated fields or flags.Another field contains the Location Grade of Service associated with thetrigger criteria; Grade of Service indicates to the Wireless LocationSystem the accuracy level and priority level desired for the locationprocessing associated with a particular trigger criteria. For example,some applications may be satisfied with a rough location estimate(perhaps for a reduced location processing fee), while otherapplications may be satisfied with low priority processing that is notguaranteed to complete for any given transmission (and which may bepreempted for high priority processing tasks). The Wireless LocationSystem also includes means to support the use of wildcards for triggercriteria in the Tasking List. For example, a trigger criteria can beentered as “MIN=215555****”. This will cause the Wireless LocationSystem to trigger location processing for any wireless transmitter whoseMIN begins with the six digits 215555 and ends with any following fourdigits. The wildcard characters can be placed into any position in atrigger criteria. This feature can save on the number of memorylocations required in the Tasking List and Signal of Interest Table bygrouping blocks of related wireless transmitters together.

ApDbSend also supports dynamic tasking. For example, the MIN, ESN, MSID,or other identity of any wireless transmitter that has dialed “911” willautomatically be placed onto the Tasking List by ApDbSend for one hour.Thus, any further transmissions by the wireless transmitter that dialed“911” will also be located in case of further emergency. For example, ifa PSAP calls back a wireless transmitter that had dialed “911” withinthe last hour, the Wireless Location System will trigger on the pageresponse message from the wireless transmitter, and can make this newlocation record available to the PSAP. This dynamic tasking can be setfor any interval of time after an initiation event, and for any type oftrigger criteria. The ApDbSend process is also a server for receivingtasking requests from other applications. These applications, such asfleet management, can send tasking requests via a socket connection, forexample. These applications can either place or remove trigger criteria.ApDbSend conducts an authentication process with each application toverify that that the application has been authorized to place or removetrigger criteria, and each application can only change trigger criteriarelated to that application.

The AP911 Process (Ap911) manages each interface between the WirelessLocation System and E9-1-1 network elements, such as tandem switches,selective routers, ALI databases and/or PSAPs. The Ap911 processcontains a separate thread for each connection to a E9-1-1 networkelement, and can support more than one thread to each network element.The Ap911 process can simultaneously operate in many modes based uponuser configuration, and as described herein. The timely processing ofE9-1-1 location records is one of the highest processing priorities inthe AP 14, and therefore the Ap911 executes entirely out of randomaccess memory (RAM) to avoid the delay associated with first storing andthen retrieving a location record from any type of disk. When ApMnDsptchforwards a location record to Ap911, Ap911 immediately makes a routingdetermination and forwards the location record over the appropriateinterface to a E9-1-1 network element. A separate process, operating inparallel, records the location record into the AP 14 database.

The AP 14, through the Ap911 process and other processes, supports twomodes of providing location records to applications, including E9-1-1:“push” and “pull” modes. Applications requesting push mode receive alocation record as soon as it is available from the AP 14. This mode isespecially effective for E9-1-1 which has a very time critical need forlocation records, since E9-1-1 networks must route wireless 9-1-1 callsto the correct PSAP within a few seconds after a wireless caller hasdialed “911”. Applications requesting pull mode do not automaticallyreceive location records, but rather must send a query to the AP 14regarding a particular wireless transmitter in order to receive thelast, or any other location record, about the wireless transmitter. Thequery from the application can specify the last location record, aseries of location records, or all location records meeting a specifictime or other criteria, such as type of transmission. An example of theuse of pull mode in the case of a “911” call is the E9-1-1 network firstreceiving the voice portion of the “911” call and then querying the AP14 to receive the location record associated with that call.

When the Ap911 process is connected to many E9-1-1 networks elements,Ap911 must determine to which E9-1-1 network element to push thelocation record (assuming that “push” mode has been selected). The AP 14makes this determination using a dynamic routing table. The dynamicrouting table is used to divide a geographic region into cells. Eachcell, or entry, in the dynamic routing table contains the routinginstructions for that cell. It is well known that one minute of latitudeis 6083 feet, which is about 365 feet per millidegree. Additionally, oneminute of longitude is cosine(latitude) times 6083 feet, which for thePhiladelphia area is about 4659 feet, or about 280 feet per millidegree.A table of size one thousand by one thousand, or one million cells, cancontain the routing instructions for an area that is about 69 miles by53 miles, which is larger than the area of Philadelphia in this example,and each cell could contain a geographic area of 365 feet by 280 feet.The number of bits allocated to each entry in the table must only beenough to support the maximum number of routing possibilities. Forexample, if the total number of routing possibilities is sixteen orless, then the memory for the dynamic routing table is one million timesfour bits, or one-half megabyte. Using this scheme, an area the size ofPennsylvania could be contained in a table of approximately twentymegabytes or less, with ample routing possibilities available. Given therelatively inexpensive cost of memory, this inventive dynamic routingtable provides the AP 14 with a means to quickly push the locationrecords for “911” calls only to the appropriate E9-1-1 network element.

The AP 14 allows each entry in dynamic routing to be populated usingmanual or automated means. Using the automated means, for example, anelectronic map application can create a polygon definition of thecoverage area of a specific E9-1-1 network element, such as a PSAP. Thepolygon definition is then translated into a list of latitude, longitudepoints contained within the polygon. The dynamic routing table cellcorresponding to each latitude, longitude point is then given therouting instruction for that E9-1-1 network element that is responsiblefor that geographic polygon.

When the Ap911 process receives a “911” location record for a specificwireless transmitter, Ap911 converts the latitude, longitude into theaddress of a specific cell in the dynamic routing table. Ap911 thenqueries the cell to determine the routing instructions, which may bepush or pull mode and the identity of the E9-1-1 network elementresponsible for serving the geographic area in which the “911” calloccurred. If push mode has been selected, then Ap911 automaticallypushes the location record to that E9-1-1 network element. If pull modehas been selected, then Ap911 places the location record into a circulartable of “911” location records and awaits a query.

The dynamic routing means described above entails the use of ageographically defined database that may be applied to otherapplications in addition to 911, and is therefore supported by otherprocesses in addition to Ap911. For example, the AP 14 can automaticallydetermine the billing zone from which a wireless call was placed for aLocation Sensitive Billing application. In addition, the AP 14 mayautomatically send an alert when a particular wireless transmitter hasentered or exited a prescribed geographic area defined by anapplication. The use of particular geographic databases, dynamic routingactions, any other location triggered actions are defined in the fieldsand flags associated with each trigger criteria. The Wireless LocationSystem includes means to easily manage these geographically defineddatabases using an electronic map that can create polygons encompassinga prescribed geographic area. The Wireless Location System extracts fromthe electronic map a table of latitude, longitude points contained withthe polygon. Each application can use its own set of polygons, and candefine a set of actions to be taken when a location record for atriggered wireless transmission is contained within each polygon in theset.

The AP Database Receive Process (ApDbRecvLoc) receives all locationrecords from ApMnDsptch via shared memory, and places the locationrecords into the AP location database. ApDbRecvLoc starts ten threadsthat each retrieve location records from shared memory, validate eachrecord before inserting the records into the database, and then insertsthe records into the correct location record partition in the database.To preserve integrity, location records with any type of error are notwritten into the location record database but are instead placed into anerror file that can be reviewed by the Wireless Location System operatorand then manually entered into the database after error resolution. Ifthe location database has failed or has been placed into off-linestatus, location records are written to a flat file where they can belater processed by ApDbFileRecv.

The AP File Receive Process (ApDbFileRecv) reads flat files containinglocation records and inserts the records into the location database.Flat files are a safe mechanism used by the AP 14 to completely preservethe integrity of the AP 14 in all cases except a complete failure of thehard disk drives. There are several different types of flat files readby ApDbFileRecv, including Database Down, Synchronization, Overflow, andFixed Error. Database Down flat files are written by the ApDbRecvLocprocess if the location database is temporarily inaccessible; this fileallows the AP 14 to ensure that location records are preserved duringthe occurrence of this type of problem. Synchronization flat files arewritten by the ApLocSync process (described below) when transferringlocation records between pairs of redundant AP systems. Overflow flatfiles are written by ApMnDsptch when location records are arriving intothe AP 14 at a rate faster than ApDbRecvLoc can process and insert therecords into the location database. This may occur during very high peakrate periods. The overflow files prevent any records from being lostduring peak periods. The Fixed Error flat files contain location recordsthat had errors but have now been fixed, and can now be inserted intothe location database.

Because the AP 14 has a critical centralized role in the WirelessLocation System, the AP 14 architecture has been designed to be fullyredundant. A redundant AP 14 system includes fully redundant hardwareplatforms, fully redundant RDBMS, redundant disk drives, and redundantnetworks to each other, the TLP's 12, the NOC's 16, and externalapplications. The software architecture of the AP 14 has also beendesigned to support fault tolerant redundancy. The following examplesillustrate functionality supported by the redundant AP's. Each TLP 12sends location records to both the primary and the redundant AP 14 whenboth AP's are in an online state. Only the primary AP 14 will processincoming tasking requests, and only the primary AP 14 will acceptconfiguration change requests from the NOC 16. The primary AP 14 thensynchronizes the redundant AP 14 under careful control. Both the primaryand redundant AP's will accept basic startup and shutdown commands fromthe NOC. Both AP's constantly monitor their own system parameters andapplication health and monitor the corresponding parameters for theother AP 14, and then decide which AP 14 will be primary and which willbe redundant based upon a composite score. This composite score isdetermined by compiling errors reported by various processes to a sharedmemory area, and monitoring swap space and disk space. There are severalprocesses dedicated to supporting redundancy.

The AP Location Synchronization Process (ApLocSync) runs on each AP 14and detects the need to synchronize location records between AP's, andthen creates “sync records” that list the location records that need tobe transferred from one AP 14 to another AP 14. The location records arethen transferred between AP's using a socket connection. ApLocSynccompares the location record partitions and the location record sequencenumbers stored in each location database. Normally, if both the primaryand redundant AP 14 are operating properly, synchronization is notneeded because both AP's are receiving location records simultaneouslyfrom the TLP's 12. However, if one AP 14 fails or is placed in anoff-line mode, then synchronization will later be required. ApLocSync isnotified whenever ApMnDsptch connects to a TLP 12 so it can determinewhether synchronization is required.

The AP Tasking Synchronization Process (ApTaskSync) runs on each AP 14and synchronizes the tasking information between the primary AP 14 andthe redundant AP 14. ApTaskSync on the primary AP 14 receives taskinginformation from ApDbSend, and then sends the tasking information to theApTaskSync process on the redundant AP 14. If the primary AP 14 were tofail before ApTaskSync had completed replicating tasks, then ApTaskSyncwill perform a complete tasking database synchronization when the failedAP 14 is placed back into an online state.

The AP Configuration Synchronization Process (ApConfigSync) runs on eachAP 14 and synchronizes the configuration information between the primaryAP 14 and the redundant AP 14. ApConfigSync uses a RDBMS replicationfacility. The configuration information includes all information neededby the SCS's 10, TLP's 12, and AP's 14 for proper operation of theWireless Location System in a wireless carrier's network.

In addition to the core functions described above, the AP 14 alsosupports a large number of processes, functions, and interfaces usefulin the operation of the Wireless Location System, as well as useful forvarious applications that desire location information. While theprocesses, functions, and interfaces described herein are in thissection pertaining to the AP 14, the implementation of many of theseprocesses, functions, and interfaces permeates the entire WirelessLocation System and therefore their inventive value should be not readas being limited only to the AP 14.

Roaming

The AP 14 supports “roaming” between wireless location systems locatedin different cities or operated by different wireless carriers. If afirst wireless transmitter has subscribed to an application on a firstWireless Location System, and therefore has an entry in the Tasking Listin the first AP 14 in the first Wireless Location System, then the firstwireless transmitter may also subscribe to roaming. Each AP 14 and TLP12 in each Wireless Location System contains a table in which a list ofvalid “home” subscriber identities is maintained. The list is typicallya range, and for example, for current cellular telephones, the range canbe determined by the NPA/NXX codes (or area code and exchange)associated with the MIN or MSID of cellular telephones. When a wirelesstransmitter meeting the “home” criteria makes a transmission, a TLP 12receives demodulated data from one or more SCS's 10 and checks thetrigger information in the Signal of Interest Table. If any triggercriterion is met, the location processing begins on that transmission;otherwise, the transmission is not processed by the Wireless LocationSystem.

When a first wireless transmitter not meeting the “home” criterion makesa transmission in a second Wireless Location System, the second TLP 12in the second Wireless Location System checks the Signal of InterestTable for a trigger. One of three actions then occurs: (i) if thetransmission meets an already existing criteria in the Signal ofInterest Table, the transmitter is located and the location record isforwarded from the second AP 14 in the second Wireless Location Systemto the first AP 14 in the first Wireless Location System; (ii) if thefirst wireless transmitter has a “roamer” entry in the Signal ofInterest Table indicating that the first wireless transmitter has“registered” in the second Wireless Location System but has no triggercriteria, then the transmission is not processed by the second WirelessLocation System and the expiration timestamp is adjusted as describedbelow; (iii) if the first wireless transmitter has no “roamer” entry andtherefore has not “registered”, then the demodulated data is passed fromthe TLP 12 to the second AP 14.

In the third case above, the second AP 14 uses the identity of the firstwireless transmitter to identify the first AP 14 in the first WirelessLocation System as the “home” Wireless Location System of the firstwireless transmitter. The second AP 14 in the second Wireless LocationSystem sends a query to the first AP 14 in the first Wireless LocationSystem to determine whether the first wireless transmitter hassubscribed to any location application and therefore has any triggercriteria in the Tasking List of the first AP 14. If a trigger is presentin the first AP 14, the trigger criteria, along with any associatedfields and flags, is sent from the first AP 14 to the second AP 14 andentered in the Tasking List and the Signal of Interest Table as a“roamer” entry with trigger criteria. If the first AP 14 responds to thesecond AP 14 indicating that the first wireless transmitter has notrigger criteria, then the second AP 14 “registers” the first wirelesstransmitter in the Tasking List and the Signal of Interest Table as a“roamer” with no trigger criteria. Thus both current and futuretransmissions from the first wireless transmitter can be positivelyidentified by the TLP 12 in the second Wireless Location System as beingregistered without trigger criteria, and the second AP 14 is notrequired to make additional queries to the first AP 14.

When the second AP 14 registers the first wireless transmitter with aroamer entry in the Tasking List and the Signal of Interest Table withor without trigger criteria, the roamer entry is assigned an expirationtimestamp. The expiration timestamp is set to the current time plus apredetermined first interval. Every time the first wireless transmittermakes a transmission, the expiration timestamp of the roamer entry inthe Tasking List and the Signal of Interest Table is adjusted to thecurrent time of the most recent transmission plus the predeterminedfirst interval. If the first wireless transmitter makes no furthertransmissions prior to the expiration timestamp of its roamer entry,then the roamer entry is automatically deleted. If, subsequent to thedeletion, the first wireless transmitter makes another transmission,then the process of registering occurs again.

The first AP 14 and second AP 14 maintain communications over a widearea network. The network may be based upon TCP/IP or upon a protocolsimilar to the most recent version of IS-41. Each AP 14 incommunications with other AP's in other wireless location systemsmaintains a table that provides the identity of each AP 14 and WirelessLocation System corresponding to each valid range of identities ofwireless transmitters.

Multiple Pass Location Records

Certain applications may require a very fast estimate of the generallocation of a wireless transmitter, followed by a more accurate estimateof the location that can be sent subsequently. This can be valuable, forexample, for E9-1-1 systems that handle wireless calls and must make acall routing decision very quickly, but can wait a little longer for amore exact location to be displayed upon the E9-1-1 call-taker'selectronic map terminal. The Wireless Location System supports theseapplications with an inventive multiple pass location processing mode,described later. The AP 14 supports this mode with multiple passlocation records. For certain entries, the Tasking List in the AP 14contains a flag indicating the maximum time limit before which aparticular application must receive a rough estimate of location, and asecond maximum time limit in which a particular application must receivea final location estimate. For these certain applications, the AP 14includes a flag in the location record indicating the status of thelocation estimate contained in the record, which may, for example, beset to first pass estimate (i.e. rough) or final pass estimate. TheWireless Location System will generally determine the best locationestimate within the time limit set by the application, that is theWireless Location System will process the most amount of RF data thatcan be supported in the time limit. Given that any particular wirelesstransmission can trigger a location record for one or more applications,the Wireless Location System supports multiple modes simultaneously. Forexample, a wireless transmitter with a particular MIN can dial “911”.This may trigger a two-pass location record for the E9-1-1 application,but a single pass location record for a fleet management applicationthat is monitoring that particular MIN. This can be extended to anynumber of applications.

Multiple Demodulation and Triggers

In wireless communications systems in urban or dense suburban areas,frequencies or channels can be re-used several times within relativelyclose distances. Since the Wireless Location System is capable ofindependently detecting and demodulating wireless transmissions withoutthe aid of the wireless communications system, a single wirelesstransmission can frequently be detected and successfully demodulated atmultiple SCS's 10 within the Wireless Location System. This can happenboth intentionally and unintentionally. An unintentional occurrence iscaused by a close frequency re-use, such that a particular wirelesstransmission can be received above a predetermined threshold at morethan one SCS 10, when each SCS 10 believes it is monitoring onlytransmissions that occur only within the cell site collocated with theSCS 10. An intentional occurrence is caused by programming more than oneSCS 10 to detect and demodulate transmissions that occur at a particularcell site and on a particular frequency. As described earlier, this isgenerally used with adjacent or nearby SCS's 10 to provide systemdemodulation redundancy to further increase the probability that anyparticular wireless transmission is successful detected and demodulated.

Either type of event could potentially lead to multiple triggers withinthe Wireless Location System, causing location processing to beinitiated several times for the same transmission. This causes an excessand inefficient use of processing and communications resources.Therefore, the Wireless Location System includes means to detect whenthe same transmission has been detected and demodulated more than once,and to select the best demodulating SCS 10 as the starting point forlocation processing. When the Wireless Location System detects andsuccessfully demodulates the same transmission multiple times atmultiple SCS/antennas, the Wireless Location System uses the followingcriteria to select the one demodulating SCS/antenna to use to continuethe process of determining whether to trigger and possibly initiatelocation processing (again, these criteria may be weighted indetermining the final decision): (i) an SCS/antenna collocated at thecell site to which a particular frequency has been assigned is preferredover another SCS/antenna, but this preference may be adjusted if thereis no operating and on-line SCS/antenna collocated at the cell site towhich the particular frequency has been assigned, (ii) SCS/antennas withhigher average SNR are preferred over those with lower average SNR, and(iii) SCS/antennas with fewer bit errors in demodulating thetransmission are preferred over those with higher bit errors. Theweighting applied to each of these preferences may be adjusted by theoperator of the Wireless Location System to suit the particular designof each system.

Interface to Wireless Communications System

The Wireless Location System contains means to communicate over aninterface to a wireless communications system, such as a mobileswitching center (MSC) or mobile positioning controller (MPC). Thisinterface may be based, for example, on a standard secure protocol suchas the most recent version of the IS-41 or TCP/IP protocols. Theformats, fields, and authentication aspects of these protocols are wellknown. The Wireless Location System supports a variety ofcommand/response and informational messages over this interface that aredesigned to aid in the successful detection, demodulation, andtriggering of wireless transmissions, as well as providing means to passlocation records to the wireless communications system. In particular,this interface provides means for the Wireless Location System to obtaininformation about which wireless transmitters have been assigned toparticular voice channel parameters at particular cell sites. Examplemessages supported by the Wireless Location System over this interfaceto the wireless communications system include the following:

Query on MIN/MDN/MSID/IMSI/TMSI Mapping—Certain types of wirelesstransmitters will transmit their identity in a familiar form that can bedialed over the telephone network. Other types of wireless transmitterstransmit an identity that cannot be dialed, but which is translated intoa number that can be dialed using a table inside of the wirelesscommunications system. The transmitted identity is permanent in mostcases, but can also be temporary. Users of location applicationsconnected to the AP 14 typically prefer to place triggers onto theTasking List using identities that can be dialed. Identities that can bedialed are typically known as Mobile Directory Numbers (MDN). The othertypes of identities for which translation may be required includesMobile Identity Number (MIN), Mobile Subscriber Identity (MSID),International Mobile Subscriber Identity (IMSI), and Temporary MobileSubscriber Identity (TMSI). If the wireless communications system hasenabled the use of encryption for any of the data fields in the messagestransmitted by wireless transmitters, the Wireless Location System mayalso query for encryption information along with the identityinformation. The Wireless Location System includes means to query thewireless communications system for the alternate identities for atrigger identity that has been placed onto the Tasking List by alocation application, or to query the wireless communications system foralternate identities for an identity that has been demodulated by an SCS10. Other events can also trigger this type of query. For this type ofquery, typically the Wireless Location System initiates the command, andthe wireless communications system responds.

Query/Command Change on Voice RF Channel Assignment—Many wirelesstransmissions on voice channels do not contain identity information.Therefore, when the Wireless Location System is triggered to performlocation processing on a voice channel transmission, the WirelessLocation System queries the wireless communication system to obtain thecurrent voice channel assignment information for the particulartransmitter for which the Wireless Location System has been triggered.For an AMPS transmission, for example, the Wireless Location Systempreferably requires the cell site, sector, and RF channel numbercurrently in use by the wireless transmitter. For a TDMA transmission,for example, the Wireless Location System preferably requires the cellsite, sector, RF channel number, and timeslot currently in use by thewireless transmitter. Other information elements that may be neededinclude long code mask and encryption keys. In general, the WirelessLocation System will initiate the command, and the wirelesscommunications system will respond. However, the Wireless LocationSystem will also accept a trigger command from the wirelesscommunications system that contains the information detailed herein.

The timing on this command/response message set is very critical sincevoice channel handoffs can occur quite frequently in wirelesscommunications systems. That is, the Wireless Location System willlocate any wireless transmitter that is transmitting on a particularchannel—therefore the Wireless Location System and the wirelesscommunications system must jointly be certain that the identity of thewireless transmitter and the voice channel assignment information are inperfect synchronization. The Wireless Location System uses several meansto achieve this objective. The Wireless Location System may, forexample, query the voice channel assignment information for a particularwireless transmitter, receive the necessary RF data, then again querythe voice channel assignment information for that same wirelesstransmitter, and then verify that the status of the wireless transmitterdid not change during the time in which the RF data was being collectedby the Wireless Location System. Location processing is not required tocomplete before the second query, since it is only important to verifythat the correct RF data was received. The Wireless Location System mayalso, for example, as part of the first query command the wirelesscommunications system to prevent a handoff from occurring for theparticular wireless transmitter during the time period in which theWireless Location System is receiving the RF data. Then, subsequent tocollecting the RF data, the Wireless Location System will again querythe voice channel assignment information for that same wirelesstransmitter, command the wireless communications system to again permithandoffs for the wireless transmitter and then verify that the status ofthe wireless transmitter did not change during the time in which the RFdata was being collected by the Wireless Location System.

For various reasons, either the Wireless Location System or the wirelesscommunications system may prefer that the wireless transmitter beassigned to another voice RF channel prior to performing locationprocessing. Therefore, as part of the command response sequence, thewireless communications system may instruct the Wireless Location Systemto temporarily suspend location processing until the wirelesscommunications system has completed a handoff sequence with the wirelesstransmitter, and the wireless communications system has notified theWireless Location System that RF data can be received and the voice RFchannel upon which the data can be received. Alternatively, the WirelessLocation System may determine that the particular voice RF channel whicha particular wireless transmitter is currently using is unsuitable forobtaining an acceptable location estimate, and request that the wirelesscommunications system command the wireless transmitter to handoff.Alternatively, the Wireless Location System may request that thewireless communications system command the wireless transmitter tohandoff to a series of voice RF channels in sequence in order to performa series of location estimates, whereby the Wireless Location System canimprove upon the accuracy of the location estimate through the series ofhandoffs. This method is further described below.

The Wireless Location System can also use this command/response messageset to query the wireless communications system about the identity of awireless transmitter that had been using a particular voice channel (andtimeslot, etc.) at a particular cell site at a particular time. Thisenables the Wireless Location System to first perform locationprocessing on transmissions without knowing the identities, and then tolater determine the identity of the wireless transmitters making thetransmissions and append this information to the location record. Thisparticular inventive feature enables the use of automatic sequentiallocation of voice channel transmissions.

Receive Triggers—The Wireless Location System can receive triggers fromthe wireless communications system to perform location processing on avoice channel transmission without knowing the identity of the wirelesstransmitter. This message set bypasses the Tasking List, and does notuse the triggering mechanisms within the Wireless Location System.Rather, the wireless communications system alone determines whichwireless transmissions to locate, and then sends a command to theWireless Location System to collect RF data from a particular voicechannel at a particular cell site and to perform location processing.The Wireless Location System responds with a confirmation containing atimestamp when the RF data was collected. The Wireless Location Systemalso responds with an appropriate format location record when locationprocessing has completed. Based upon the time of the command to WirelessLocation System and the response with the RF data collection timestamp,the wireless communications system determines whether the wirelesstransmitter status changed subsequent to the command and whether thereis a good probability of successful RF data collection.

Make Transmit—The Wireless Location System can command the wirelesscommunications system to force a particular wireless transmitter to makea transmission at a particular time, or within a prescribed range oftimes. The wireless communications system responds with a confirmationand a time or time range in which to expect the transmission. The typesof transmissions that the Wireless Location System can force include,for example, audit responses and page responses. Using this message set,the Wireless Location System can also command the wirelesscommunications system to force the wireless transmitter to transmitusing a higher power level setting. In many cases, wireless transmitterswill attempt to use the lowest power level settings when transmitting inorder to conserve battery life. In order improve the accuracy of thelocation estimate, the Wireless Location System may prefer that thewireless transmitter use a higher power level setting. The wirelesscommunications system will respond to the Wireless Location System witha confirmation that the higher power level setting will be used and atime or time range in which to expect the transmission.

Delay Wireless Communications System Response to Mobile Access—Some airinterface protocols, such as CDMA, use a mechanism in which the wirelesstransmitter initiates transmissions on a channel, such as an AccessChannel, for example, at the lowest or a very low power level setting,and then enters a sequence of steps in which (i) the wirelesstransmitter makes an access transmission; (ii) the wireless transmitterwaits for a response from the wireless communications system; (iii) ifno response is received by the wireless transmitter from the wirelesscommunications system within a predetermined time, the wirelesstransmitter increases its power level setting by a predetermined amount,and then returns to step (i); (iv) if a response is received by thewireless transmitter from the wireless communications system within apredetermined time, the wireless transmitter then enters a normalmessage exchange. This mechanism is useful to ensure that the wirelesstransmitter uses only the lowest useful power level setting fortransmitting and does not further waste energy or battery life. It ispossible, however, that the lowest power level setting at which thewireless transmitter can successfully communicate with the wirelesscommunications system is not sufficient to obtain an acceptable locationestimate. Therefore, the Wireless Location System can command thewireless communications system to delay its response to thesetransmissions by a predetermined time or amount. This delaying actionwill cause the wireless transmitter to repeat the sequence of steps (i)through (iii) one or more times than normal with the result that one ormore of the access transmissions will be at a higher power level thannormal. The higher power level may preferably enable the WirelessLocation System to determine a more accurate location estimate. TheWireless Location System may command this type of delaying action foreither a particular wireless transmitter, for a particular type ofwireless transmission (for example, for all ‘911’ calls), for wirelesstransmitters that are at a specified range from the base station towhich the transmitter is attempting to communicate, or for all wirelesstransmitters in a particular area.

Send Confirmation to Wireless Transmitter—The Wireless Location Systemdoes not include means within itself to notify the wireless transmitterof an action because the Wireless Location System cannot transmit; asdescribed earlier the Wireless Location System can only receivetransmissions. Therefore, if the Wireless Location System desires tosend, for example, a confirmation tone upon the completion of a certainaction, the Wireless Location System commands the wirelesscommunications system to transmit a particular message. The message mayinclude, for example, an audible confirmation tone, spoken message, orsynthesized message to the wireless transmitter, or a text message sentvia a short messaging service or a page. The Wireless Location Systemreceives confirmation from the wireless communications system that themessage has been accepted and sent to the wireless transmitter. Thiscommand/response message set is important in enabling the WirelessLocation System to support certain end-user application functions suchas Prohibit Location Processing.

Report Location Records—The Wireless Location System automaticallyreports location records to the wireless communications system for thosewireless transmitters tasked to report to the wireless communicationssystem, as well as for those transmissions that the wirelesscommunications system initiated triggers. The Wireless Location Systemalso reports on any historical location record queried by the wirelesscommunications system and which the wireless communications system isauthorized to receive.

Monitor Internal Wireless Communications System Interfaces, State Table

In addition to this above interface between the Wireless Location Systemand the wireless communications system, the Wireless Location Systemalso includes means to monitor existing interfaces within the wirelesscommunications system for the purpose of intercepting messages importantto the Wireless Location System for identifying wireless transmittersand the RF channels in use by these transmitters. These interfaces mayinclude, for example, the “A interface” and “Abis interface” used inwireless communications systems employing the GSM air interfaceprotocol. (This aspect of the present invention is described in greaterdetail below in the section titled “Monitoring of Call Information”.)These interfaces are well known and published in various standards. Bymonitoring the bidirectional messages on these interfaces between basestations (BTS), base station controllers (BSC), and mobile switchingcenters (MSC), and other points, the Wireless Location System can obtainthe same information about the assignment of wireless transmitters tospecific channels as the wireless communications system itself knows.The Wireless Location System includes means to monitor these interfacesat various points. For example, the SCS 10 may monitor a BTS to BSCinterface. Alternately, a TLP 12 or AP 14 may also monitor a BSC where anumber of BTS to BSC interfaces have been concentrated. The interfacesinternal to the wireless communications system are not encrypted and thelayered protocols are known to those familiar with the art. Theadvantage to the Wireless Location System to monitoring these interfacesis that the Wireless Location System may not be required toindependently detect and demodulate control channel messages fromwireless transmitters. In addition, the Wireless Location System mayobtain all necessary voice channel assignment information from theseinterfaces.

Using these means for a control channel transmission, the SCS 10receives the transmissions as described earlier and records the controlchannel RF data into memory without performing detection anddemodulation. Separately, the Wireless Location System monitors themessages occurring over prescribed interfaces within the wirelesscommunications system, and causes a trigger in the Wireless LocationSystem when the Wireless Location System discovers a message containinga trigger event. Initiated by the trigger event, the Wireless LocationSystem determines the approximately time at which the wirelesstransmission occurred, and commands a first SCS 10 and a second SCS 10Bto each search its memory for the start of transmission. This first SCS10A chosen is an SCS that is either collocated with the base station towhich the wireless transmitter had communicated, or an SCS which isadjacent to the base station to which the wireless transmitter hadcommunicated. That is, the first SCS 10A is an SCS which would have beenassigned the control channel as a primary channel. If the first SCS 10Asuccessfully determines and reports the start of the transmission, thenlocation processing proceeds normally, using the means described below.If the first SCS 10A cannot successfully determine the start oftransmission, then the second SCS 10B reports the start of transmission,and then location processing proceeds normally.

The Wireless Location System also uses these means for voice channeltransmissions. For all triggers contained in the Tasking List, theWireless Location System monitors the prescribed interfaces for messagespertaining to those triggers. The messages of interest include, forexample, voice channel assignment messages, handoff messages, frequencyhopping messages, power up/power down messages, directed re-trymessages, termination messages, and other similar action and statusmessages. The Wireless Location System continuously maintains a copy ofthe state and status of these wireless transmitters in a State Table inthe AP 14. Each time that the Wireless Location System detects a messagepertaining to one of the entries in the Tasking List, the WirelessLocation System updates its own State Table. Thereafter, the WirelessLocation System may trigger to perform location processing, such as on aregular time interval, and access the State Table to determine preciselywhich cell site, sector, RF channel, and timeslot is presently beingused by the wireless transmitter. The example contained herein describedthe means by which the Wireless Location System interfaces to a GSMbased wireless communications system. The Wireless Location System alsosupports similar functions with systems based upon other air interfaces.

For certain air interfaces, such as CDMA, the Wireless Location Systemalso keeps certain identity information obtained from Access bursts inthe control channel in the State Table; this information is later usedfor decoding the masks used for voice channels. For example, the CDMAair interface protocol uses the Electronic Serial Number (ESN) of awireless transmitter to, in part, determine the long code mask used inthe coding of voice channel transmissions. The Wireless Location Systemmaintains this information in the State Table for entries in the TaskingList because many wireless transmitters may transmit the informationonly once; for example, many CDMA mobiles will only transmit their ESNduring the first Access burst after the wireless transmitter becomeactive in a geographic area. This ability to independently determine thelong code mask is very useful in cases where an interface between theWireless Location System and the wireless communications system is notoperative and/or the Wireless Location System is not able to monitor oneof the interfaces internal to the wireless communications system. Theoperator of the Wireless Location System may optionally set the WirelessLocation System to maintain the identity information for all wirelesstransmitters. In addition to the above reasons, the Wireless LocationSystem can provide the voice channel tracking for all wirelesstransmitters that trigger location processing by calling “911”. Asdescribed earlier, the Wireless Location System uses dynamic tasking toprovide location to a wireless transmitter for a prescribed time afterdialing “911”, for example. By maintaining the identity information forall wireless transmitters in the State Table, the Wireless LocationSystem is able to provide voice channel tracking for all transmitters inthe event of a prescribed trigger event, and not just those with priorentries in the Tasking List.

Applications Interface

Using the AP 14, the Wireless Location System supports a variety ofstandards based interfaces to end-user and carrier location applicationsusing secure protocols such as TCP/IP, X.25, SS-7, and IS-41. Eachinterface between the AP 14 and an external application is a secure andauthenticated connection that permits the AP 14 to positively verify theidentity of the application that is connected to the AP 14. This isnecessary because each connected application is granted only limitedaccess to location records on a real-time and/or historical basis. Inaddition, the AP 14 supports additional command/response, real-time, andpost-processing functions that are further detailed below. Access tothese additional functions also requires authentication. The AP 14maintains a user list and the authentication means associated with eachuser. No application can gain access to location records or functionsfor which the application does not have proper authentication or accessrights. In addition, the AP 14 supports full logging of all actionstaken by each application in the event that problems arise or a laterinvestigation into actions is required. For each command or function inthe list below, the AP 14 preferably supports a protocol in which eachaction or the result of each is confirmed, as appropriate.

Edit Tasking List—This command permits external applications to add,remove, or edit entries in the Tasking List, including any fields andflags associated with each entry. This command can be supported on asingle entry basis, or a batch entry basis where a list of entries isincluded in a single command. The latter is useful, for example, in abulk application such as location sensitive billing whereby largervolumes of wireless transmitters are being supported by the externalapplication, and it is desired to minimize protocol overhead. Thiscommand can add or delete applications for a particular entry in theTasking List, however, this command cannot delete an entry entirely ifthe entry also contains other applications not associated with orauthorized by the application issuing the command.

Set Location Interval—The Wireless Location System can be set to performlocation processing at any interval for a particular wirelesstransmitter, on either control or voice channels. For example, certainapplications may require the location of a wireless transmitter everyfew seconds when the transmitter is engaged on a voice channel. When thewireless transmitter make an initial transmission, the Wireless LocationSystem initially triggers using a standard entry in the Tasking List. Ifone of the fields or flags in this entry specifies updated location on aset interval, then the Wireless Location System creates a dynamic taskin the Tasking List that is triggered by a timer instead of an identityor other transmitted criteria. Each time the timer expires, which canrange from 1 second to several hours, the Wireless Location System willautomatically trigger to locate the wireless transmitter. The WirelessLocation System uses its interface to the wireless communications systemto query status of the wireless transmitter, including voice callparameters as described earlier. If the wireless transmitter is engagedon a voice channel, then the Wireless Location System performs locationprocessing. If the wireless transmitter is not engaged in any existingtransmissions, the Wireless Location System will command the wirelesscommunications system to make the wireless transmitter immediatelytransmit. When the dynamic task is set, the Wireless Location Systemalso sets an expiration time at which the dynamic task ceases.

End-User Addition/Deletion—This command can be executed by an end-userof a wireless transmitter to place the identity of the wirelesstransmitter onto the Tasking List with location processing enabled, toremove the identity of the wireless transmitter from the Tasking Listand therefore eliminate identity as a trigger, or to place the identityof the wireless transmitter onto the Tasking List with locationprocessing disabled. When location processing has been disabled by theend-user, known as Prohibit Location Processing then no locationprocessing will be performed for the wireless transmitter. The operatorof the Wireless Location System can optionally select one of severalactions by the Wireless Location System in response to a ProhibitLocation Processing command by the end user: (i) the disabling actioncan override all other triggers in the Tasking List, including a triggerdue to an emergency call such as “911”, (ii) the disabling action canoverride any other trigger in the Tasking List, except a trigger due toan emergency call such as “911”, (iii) the disabling action can beoverridden by other select triggers in the Tasking List. In the firstcase, the end-user is granted complete control over the privacy of thetransmissions by the wireless transmitter, as no location processingwill be performed on that transmitter for any reason. In the secondcase, the end-user may still receive the benefits of location during anemergency, but at no other times. In an example of the third case, anemployer who is the real owner of a particular wireless transmitter canoverride an end-user action by an employee who is using the wirelesstransmitter as part of the job but who may not desire to be located. TheWireless Location System may query the wireless communications system,as described above, to obtain the mapping of the identity contained inthe wireless transmission to other identities.

The additions and deletions by the end-user are effected by dialedsequences of characters and digits and pressing the “SEND” or equivalentbutton on the wireless transmitter. These sequences may be optionallychosen and made known by the operator of the Wireless Location System.For example, one sequence may be “*55 SEND” to disable locationprocessing. Other sequences are also possible. When the end-user candialed this prescribed sequence, the wireless transmitter will transmitthe sequence over one of the prescribed control channels of the wirelesscommunications system. Since the Wireless Location System independentlydetects and demodulates all reverse control channel transmissions, theWireless Location System can independently interpret the prescribeddialed sequence and make the appropriate feature updates to the TaskingList, as described above. When the Wireless Location System hascompleted the update to the Tasking List, the Wireless Location Systemcommands the wireless communications system to send a confirmation tothe end-user. As described earlier, this may take the form of an audibletone, recorded or synthesized voice, or a text message. This command isexecuted over the interface between the Wireless Location System and thewireless communications system.

Command Transmit—This command allows external applications to cause theWireless Location System to send a command to the wirelesscommunications system to make a particular wireless transmitter, orgroup of wireless transmitters, transmit. This command may contain aflag or field that the wireless transmitter(s) should transmitimmediately or at a prescribed time. This command has the effort oflocating the wireless transmitter(s) upon command, since thetransmissions will be detected, demodulated, and triggered, causinglocation processing and the generation of a location record. This isuseful in eliminating or reducing any delay in determining location suchas waiting for the next registration time period for the wirelesstransmitter or waiting for an independent transmission to occur.

External Database Query and Update—The Wireless Location System includesmeans to access an external database, to query the said externaldatabase using the identity of the wireless transmitter or otherparameters contained in the transmission or the trigger criteria, and tomerge the data obtained from the external database with the datagenerated by the Wireless Location System to create a new enhancedlocation record. The enhanced location record may then be forwarded torequesting applications. The external database may contain, for example,data elements such as customer information, medical information,subscribed features, application related information, customer accountinformation, contact information, or sets of prescribed actions to takeupon a location trigger event. The Wireless Location System may alsocause updates to the external database, for example, to increment ordecrement a billing counter associated with the provision of locationservices, or to update the external database with the latest locationrecord associated with the particular wireless transmitter. The WirelessLocation System contains means to performed the actions described hereinon more than one external database. The list and sequence of externaldatabases to access and the subsequent actions to take are contained inone of the fields contained in the trigger criteria in the Tasking List.

Random Anonymous Location Processing—The Wireless Location Systemincludes means to perform large scale random anonymous locationprocessing. This function is valuable to certain types of applicationsthat require the gathering of a large volume of data about a populationof wireless transmitters without consideration to the specificidentities of the individual transmitters. Applications of this typeinclude: RF Optimization, which enables wireless carriers to measure theperformance of the wireless communications system by simultaneouslydetermining location and other parameters of a transmission; TrafficManagement, which enables government agencies and commercial concerns tomonitor the flow of traffic on various highways using statisticallysignificant samples of wireless transmitters travelling in vehicles; andLocal Traffic Estimation, which enables commercial enterprises toestimate the flow of traffic around a particular area which may helpdetermine the viability of particular businesses.

Applications requesting random anonymous location processing optionallyreceive location records from two sources: (i) a copy of locationrecords generated for other applications, and (ii) location recordswhich have been triggered randomly by the Wireless Location Systemwithout regard to any specific criteria. All of the location recordsgenerated from either source are forwarded with all of the identity andtrigger criteria information removed from the location records; however,the requesting application(s) can determine whether the record wasgenerated from the fully random process or is a copy from anothertrigger criteria. The random location records are generated by a lowpriority task within the Wireless Location System that performs locationprocessing on randomly selected transmissions whenever processing andcommunications resources are available and would otherwise be unused ata particular instant in time. The requesting application(s) can specifywhether the random location processing is performed over the entirecoverage area of a Wireless Location System, over specific geographicareas such as along prescribed highways, or by the coverage areas ofspecific cell sites. Thus, the requesting application(s) can direct theresources of the Wireless Location System to those area of greatestinterest to each application. Depending on the randomness desired by theapplication(s), the Wireless Location System can adjust preferences forrandomly selecting certain types of transmissions, for example,registration messages, origination messages, page response messages, orvoice channel transmissions.

Anonymous Tracking of a Geographic Group—The Wireless Location Systemincludes means to trigger location processing on a repetitive basis foranonymous groups of wireless transmitters within a prescribed geographicarea. For example, a particular location application may desire tomonitor the travel route of a wireless transmitter over a prescribedperiod of time, but without the Wireless Location System disclosing theparticular identity of the wireless transmitter. The period of time maybe many hours, days, or weeks. Using the means, the Wireless LocationSystem: randomly selects a wireless transmitter that initiates atransmission in the geographic area of interest to the application;performs location processing on the transmission of interest;irreversibly translates and encrypts the identity of the wirelesstransmitter into a new coded identifier; creates a location record usingonly the new coded identifier as an identifying means; forwards thelocation record to the requesting location application(s); and creates adynamic task in the Tasking List for the wireless transmitter, whereinthe dynamic task has an associated expiration time. Subsequently,whenever the prescribed wireless transmitter initiates transmission, theWireless Location System may trigger using the dynamic task, performlocation processing on the transmission of interest, irreversiblytranslate and encrypt the identity of the wireless transmitter into thenew coded identifier using the same means as prior such that the codedidentifier is the same, create a location record using the codedidentifier, and forward the location record to the requesting locationapplication(s). The means described herein can be combined with otherfunctions of the Wireless Location System to perform this type ofmonitoring use either control or voice channel transmissions. Further,the means described herein completely preserve the private identity ofthe wireless transmitter, yet enables another class of applications thatcan monitor the travel patterns of wireless transmitters. This class ofapplications can be of great value in determining the planning anddesign of new roads, alternate route planning, or the construction ofcommercial and retail space.

Location Record Grouping, Sorting, and Labeling—The Wireless LocationSystem include means to post-process the location records for certainrequesting applications to group, sort, or label the location records.For each interface supported by the Wireless Location System, theWireless Location System stores a profile of the types of data for whichthe application is both authorized and requesting, and the types offilters or post-processing actions desired by the application. Manyapplications, such as the examples contained herein, do not requireindividual location records or the specific identities of individualtransmitters. For example, an RF optimization application derives morevalue from a large data set of location records for a particular cellsite or channel than it can from any individual location record. Foranother example, a traffic monitoring application requires only locationrecords from transmitters that are on prescribed roads or highways, andadditionally requires that these records be grouped by section of roador highway and by direction of travel. Other applications may requestthat the Wireless Location System forward location records that havebeen formatted to enhance visual display appeal by, for example,adjusting the location estimate of the transmitter so that thetransmitter's location appears on an electronic map directly on a drawnroad segment rather than adjacent to the road segment. Therefore, theWireless Location System preferably “snaps” the location estimate to thenearest drawn road segment.

The Wireless Location System can filter and report location records toan application for wireless transmitters communicating only on aparticular cell site, sector, RF channel, or group of RF channels.Before forwarding the record to the requesting application, the WirelessLocation System first verifies that the appropriate fields in the recordsatisfy the requirements. Records not matching the requirements are notforwarded, and records matching the requirements are forwarded. Somefilters are geographic and must be calculated by the Wireless LocationSystem. For example, the Wireless Location System can process a locationrecord to determine the closest road segment and direction of travel ofthe wireless transmitter on the road segment. The Wireless LocationSystem can then forward only records to the application that aredetermined to be on a particular road segment, and can further enhancethe location record by adding a field containing the determined roadsegment. In order to determine the closest road segment, the WirelessLocation System is provided with a database of road segments of interestby the requesting application. This database is stored in a table whereeach road segment is stored with a latitude and longitude coordinatedefining the end point of each segment. Each road segment can be modeledas a straight or curved line, and can be modeled to support one or twodirections of travel. Then for each location record determined by theWireless Location System, the Wireless Location System compares thelatitude and longitude in the location record to each road segmentstored in the database, and determines the shortest distance from amodeled line connecting the end points of the segment to the latitudeand longitude of the location record. The shortest distance is acalculated imaginary line orthogonal to the line connecting the two endpoints of the stored road segment. When the closest road segment hasbeen determined, the Wireless Location System can further determine thedirection of travel on the road segment by comparing the direction oftravel of the wireless transmitter reported by the location processingto the orientation of the road segment. The direction that produces thesmallest error with respect to the orientation of the road segments isthen reported by the Wireless Location System.

Network Operations Console (NOC) 16

The NOC 16 is a network management system that permits operators of theWireless Location System easy access to the programming parameters ofthe Wireless Location System. For example, in some cities, the WirelessLocation System may contain many hundreds or even thousands of SCS's 10.The NOC is the most effective way to manage a large Wireless LocationSystem, using graphical user interface capabilities. The NOC will alsoreceive real time alerts if certain functions within the WirelessLocation System are not operating properly. These real time alerts canbe used by the operator to take corrective action quickly and prevent adegradation of location service. Experience with trials of the WirelessLocation System show that the ability of the system to maintain goodlocation accuracy over time is directly related to the operator'sability to keep the system operating within its predeterminedparameters.

Location Processing

The Wireless Location System is capable of performing locationprocessing using two different methods known as central based processingand station based processing. Both techniques were first disclosed inU.S. Pat. No. 5,327,144, and are further enhanced in this specification.Location processing depends in part on the ability to accuratelydetermine certain phase characteristics of the signal as received atmultiple antennas and at multiple SCS's 10. Therefore, it is an objectof the Wireless Location System to identify and remove sources of phaseerror that impede the ability of the location processing to determinethe phase characteristics of the received signal. One source of phaseerror is inside of the wireless transmitter itself, namely theoscillator (typically a crystal oscillator) and the phase lock loopsthat allow the phone to tune to specific channels for transmitting.Lower cost crystal oscillators will generally have higher phase noise.Some air interface specifications, such as IS-136 and IS-95A, havespecifications covering the phase noise with which a wireless telephonecan transmit. Other air interface specifications, such as IS-553A, donot closely specify phase noise. It is therefore an object of thepresent invention to automatically reduce and/or eliminate a wirelesstransmitter's phase noise as a source of phase error in locationprocessing, in part by automatically selecting the use of central basedprocessing or station based processing. The automatic selection willalso consider the efficiency with which the communications link betweenthe SCS 10 and the TLP 12 is used, and the availability of DSP resourcesat each of the SCS 10 and TLP 12.

When using central based processing, the TDOA and FDOA determination andthe multipath processing are performed in the TLP 12 along with theposition and speed determination. This method is preferred when thewireless transmitter has a phase noise that is above a predeterminedthreshold. In these cases, central based processing is most effective inreducing or eliminating the phase noise of the wireless transmitter as asource of phase error because the TDOA estimate is performed using adigital representation of the actual RF transmission from two antennas,which may be at the same SCS 10 or different SCS's 10. In this method,those skilled in the art will recognize that the phase noise of thetransmitter is a common mode noise in the TDOA processing, and thereforeis self-canceling in the TDOA determination process. This method worksbest, for example, with many very low cost AMPS cellular telephones thathave a high phase noise. The basic steps in central based processinginclude the steps recited below and represented in the flowchart of FIG.6:

a wireless transmitter initiates a transmission on either a controlchannel or a voice channel (step S50);

the transmission is received at multiple antennas and at multiple SCS's10 in the Wireless Location System (step S51);

the transmission is converted into a digital format in the receiverconnected to each SCS/antenna (step S52);

the digital data is stored in a memory in the receivers in each SCS 10(step S53);

the transmission is demodulated (step S54);

the Wireless Location System determines whether to begin locationprocessing for the transmission (step S55);

if triggered, the TLP 12 requests copies of the digital data from thememory in receivers at multiple SCS's 10 (step S56);

digital data is sent from multiple SCS's 10 to a selected TLP 12 (stepS57);

the TLP 12 performs TDOA, FDOA, and multipath mitigation on the digitaldata from pairs of antennas (step S58);

the TLP 12 performs position and speed determination using the TDOAdata, and then creates a location record and forwards the locationrecord to the AP 14 (step S59).

The Wireless Location System uses a variable number of bits to representthe transmission when sending digital data from the SC S's 10 to the TLP12. As discussed earlier, the SCS receiver digitizes wirelesstransmissions with a high resolution, or a high number of bits perdigital sample in order to achieve a sufficient dynamic range. This isespecially required when using wideband digital receivers, which may besimultaneously receiving signals near to the SCS 10A and far from theSCS 10B. For example, up to 14 bits may be required to represent adynamic range of 84 dB. Location processing does not always require thehigh resolution per digital sample, however. Frequently, locations ofsufficient accuracy are achievable by the Wireless Location System usinga fewer number of bits per digital sample. Therefore, to minimize theimplementation cost of the Wireless Location System by conservingbandwidth on the communication links between each SCS 10 and TLP 12, theWireless Location System determines the fewest number of bits requiredto digitally represent a transmission while still maintaining a desiredaccuracy level. This determination is based, for example, on theparticular air interface protocol used by the wireless transmitter, theSNR of the transmission, the degree to which the transmission has beenperturbed by fading and/or multipath, and the current state of theprocessing and communication queues in each SCS 10. The number of bitssent from the SCS 10 to the TLP 12 are reduced in two ways: the numberof bits per sample is minimized, and the shortest length, or fewestsegments, of the transmission possible is used for location processing.The TLP 12 can use this minimal RF data to perform location processingand then compare the result with the desired accuracy level. Thiscomparison is performed on the basis of a confidence intervalcalculation. If the location estimate does not fall within the desiredaccuracy limits, the TLP 12 will recursively request additional datafrom selected SCS's 10. The additional data may include an additionalnumber of bits per digital sample and/or may include more segments ofthe transmission. This process of requesting additional data maycontinue recursively until the TLP 12 has achieved the prescribedlocation accuracy.

There are additional details to the basic steps described above. Thesedetails are described in prior U.S. Pat. Nos. 5,327,144 and 5,608,410 inother parts of this specification. One enhancement to the processesdescribed in earlier patents is the selection of a single referenceSCS/antenna that is used for each baseline in the location processing.In prior art, baselines were determined using pairs of antenna sitesaround a ring. In the present Wireless Location System, the singlereference SCS/antenna used is generally the highest SNR signal, althoughother criteria are also used as described below. The use of a high SNRreference aids central based location processing when the otherSCS/antennas used in the location processing are very weak, such as ator below the noise floor (i.e. zero or negative signal to noise ratio).When station based location processing is used, the reference signal isa re-modulated signal, which is intentionally created to have a veryhigh signal to noise ratio, further aiding location processing for veryweak signals at other SCS/antennas. The actual selection of thereference SCS/antenna is described below.

The Wireless Location System mitigates multipath by first recursivelyestimating the components of multipath received in addition to thedirect path component and then subtracting these components from thereceived signal. Thus the Wireless Location System models the receivedsignal and compares the model to the actual received signal and attemptsto minimize the difference between the two using a weighted least squaredifference. For each transmitted signal x(t) from a wirelesstransmitter, the received signal y(t) at each SCS/antenna is a complexcombination of signals:

y(t)=Σx(t−τ _(n))a _(n) e ^(jω(t−τn)), for all n=0 to N;

where

x(t) is the signal as transmitted by the wireless transmitter;

a_(n) and τ_(n) are the complex amplitude and delays of the multipathcomponents;

N is the total number of multipath components in the received signal;and

a₀ and τ₀ are constants for the most direct path component.

The operator of the Wireless Location System empirically determines aset of constraints for each component of multipath that applies to thespecific environment in which each Wireless Location System isoperating. The purpose of the constraints is to limit the amount ofprocessing time that the Wireless Location System spends optimizing theresults for each multipath mitigation calculation. For example, theWireless Location System may be set to determine only four components ofmultipath: the first component may be assumed to have a time delay inthe range τ_(1A) to τ_(1B); the second component may be assumed to havea time delay in the range τ_(2A) to τ_(2B); the third component may beassumed to have a time delay in the range τ_(3A) to τ_(3B); and similarfor the fourth component; however the fourth component is a single valuethat effectively represents a complex combination of many tens ofindividual (and somewhat diffuse) multipath components whose time delaysexceed the range of the third component. For ease of processing, theWireless Location System transforms the prior equation into thefrequency domain, and then solves for the individual components suchthat a weighted least squares difference is minimized.

When using station based processing, the TDOA and FDOA determination andmultipath mitigation are performed in the SCS's 10, while the positionand speed determination are typically performed in the TLP 12. The mainadvantage of station based processing, as described in U.S. Pat. No.5,327,144, is reducing the amount of data that is sent on thecommunication link between each SCS 10 and TLP 12. However, there may beother advantages as well. One new objective of the present invention isincreasing the effective signal processing gain during the TDOAprocessing. As pointed out earlier, central based processing has theadvantage of eliminating or reducing phase error caused by the phasenoise in the wireless transmitter. However, no previous disclosure hasaddressed how to eliminate or reduce the same phase noise error whenusing station based processing. The present invention reduces the phaseerror and increases the effective signal processing gain using the stepsrecited below and shown in FIG. 6:

a wireless transmitter initiates a transmission on either a controlchannel or a voice channel (step S60);

the transmission is received at multiple antennas and at multiple SCS's10 in the Wireless Location System (step S61);

the transmission is converted into a digital format in the receiverconnected to each antenna (step S62);

the digital data is stored in a memory in the SCS 10 (step S63);

the transmission is demodulated (step S64);

the Wireless Location System determines whether to begin locationprocessing for the transmission (step S65);

if triggered, a first SCS 10A demodulates the transmission anddetermines an appropriate phase correction interval (step S66);

for each such phase correction interval, the first SCS 10A calculates anappropriate phase correction and amplitude correction, and encodes thisphase correction parameter and amplitude correction parameter along withthe demodulated data (step S67);

the demodulated data and phase correction and amplitude correctionparameters are sent from the first SCS 10A to a TLP 12 (step S68);

the TLP 12 determines the SCS's 10 and receiving antennas to use in thelocation processing (step S69);

the TLP 12 sends the demodulated data and phase correction and amplitudecorrection parameters to each second SCS 10B that will be used in thelocation processing (step S70);

the first SCS 10 and each second SCS 10B creates a first re-modulatedsignal based upon the demodulated data and the phase correction andamplitude correction parameters (step S71);

the first SCS 10A and each second SCS 10B performs TDOA, FDOA, andmultipath mitigation using the digital data stored in memory in each SCS10 and the first re-modulated signal (step S72);

the TDOA, FDOA, and multipath mitigation data are sent from the firstSCS 10A and each second SCS 10B to the TLP 12 (step S73);

the TLP 12 performs position and speed determination using the TDOA data(step S74); and

the TLP 12 creates a location record, and forwards the location recordto the AP 14 (step S75).

The advantages of determining phase correction and amplitude correctionparameters are most obvious in the location of CDMA wirelesstransmitters based upon IS-95A. As is well known, the reversetransmissions from an IS-95A transmitter are sent using non-coherentmodulation. Most CDMA base stations only integrate over a single bitinterval because of the non-coherent modulation. For a CDMA AccessChannel, with a bit rate of 4800 bits per second, there are 256 chipssent per bit, which permits an integration gain of 24 dB. Using thetechnique described above, the TDOA processing in each SCS 10 mayintegrate, for example, over a full 160 millisecond burst (196,608chips) to produce an integration gain of 53 dB. This additionalprocessing gain enables the present invention to detect and locate CDMAtransmissions using multiple SCS's 10, even if the base stationscollocated with the SCS's 10 cannot detect the same CDMA transmission.

For a particular transmission, if either the phase correction parametersor the amplitude correction parameters are calculated to be zero, or arenot needed, then these parameters are not sent in order to conserve onthe number of bits transmitted on the communications link between eachSCS 10 and TLP 12. In another embodiment of the invention, the WirelessLocation System may use a fixed phase correction interval for aparticular transmission or for all transmissions of a particular airinterface protocol, or for all transmissions made by a particular typeof wireless transmitter. This may, for example, be based upon empiricaldata gathered over some period of time by the Wireless Location Systemshowing a reasonable consistency in the phase noise exhibited by variousclasses of transmitters. In these cases, the SCS 10 may save theprocessing step of determining the appropriate phase correctioninterval.

Those skilled in the art will recognize that there are many ways ofmeasuring the phase noise of a wireless transmitter. In one embodiment,a pure, noiseless re-modulated copy of the signal received at the firstSCS 10A may be digitally generated by DSP's in the SCS, then thereceived signal may be compared against the pure signal over each phasecorrection interval and the phase difference may be measured directly.In this embodiment, the phase correction parameter will be calculated asthe negative of the phase difference over that phase correctioninterval. The number of bits required to represent the phase correctionparameter will vary with the magnitude of the phase correctionparameter, and the number of bits may vary for each phase correctioninterval. It has been observed that some transmissions, for example,exhibit greater phase noise early in the transmission, and less phasenoise in the middle of and later in the transmission.

Station based processing is most useful for wireless transmitters thathave relatively low phase noise. Although not necessarily required bytheir respective air interface standards, wireless telephones that usethe TDMA, CDMA, or GSM protocols will typically exhibit lower phasenoise. As the phase noise of a wireless transmitter increases, thelength of a phase correction interval may decrease and/or the number ofbits required to represent the phase correction parameters increases.Station based processing is not effective when the number of bitsrequired to represent the demodulated data plus the phase correction andamplitude parameters exceeds a predetermined proportion of the number ofbits required to perform central based processing. It is therefore anobject of the present invention to automatically determine for eachtransmission for which a location is desired whether to process thelocation using central based processing or station based processing. Thesteps in making this determination are recited below and shown in FIG.7:

a wireless transmitter initiates a transmission on either a controlchannel or a voice channel (step S80);

the transmission is received at a first SCS 10A (step S81);

the transmission is converted into a digital format in the receiverconnected to each antenna (step S82);

the Wireless Location System determines whether to begin locationprocessing for the transmission (step S83);

if triggered, a first SCS 10A demodulates the transmission and estimatesan appropriate phase correction interval and the number of bits requiredto encode the phase correction and amplitude correction parameters (stepS84);

the first SCS 10A then estimates the number of bits required for centralbased processing;

based upon the number of bits required for each respective method, theSCS 10 or the TLP 12 determine whether to use central based processingor station based processing to perform the location processing for thistransmission (step S85).

In another embodiment of the invention, the Wireless Location System mayalways use central based processing or station based processing for alltransmissions of a particular air interface protocol, or for alltransmissions made by a particular kind of wireless transmitter. Thismay, for example, be based upon empirical data gathered over some periodof time by the Wireless Location System showing a reasonable consistencyin the phase noise exhibited by various classes of transmitters. Inthese cases, the SCS 10 and/or the TLP 12 may be saved the processingstep of determining the appropriate processing method.

A further enhancement of the present invention, used for both centralbased processing and station based processing, is the use of thresholdcriteria for including baselines in the final determination of locationand velocity of the wireless transmitter. For each baseline, theWireless Location System calculates a number of parameters that include:the SCS/antenna port used with the reference SCS/antenna in calculatingthe baseline, the peak, average, and variance in the power of thetransmission as received at the SCS/antenna port used in the baselineand over the interval used for location processing, the correlationvalue from the cross-spectra correlation between the SCS/antenna used inthe baseline and the reference SCS/antenna, the delay value for thebaseline, the multipath mitigation parameters, the residual valuesremaining after the multipath mitigation calculations, the contributionof the SCS/antenna to the weighted GDOP in the final location solution,and a measure of the quality of fit of the baseline if included in thefinal location solution. Each baseline is included in the final locationsolution is each meets or exceeds the threshold criteria for each of theparameters described herein. A baseline may be excluded from thelocation solution if it fails to meet one or more of the thresholdcriteria. Therefore, it is frequently possible that the number ofSCS/antennas actually used in the final location solution is less thanthe total number considered.

Previous U.S. Pat. Nos. 5,327,144 and 5,608,410 disclosed a method bywhich the location processing minimized the least square difference(LSD) value of the following equation:

 LSD=[Q ₁₂(Delay_(—) T ₁₂−Delay_(—) O ₁₂)² +Q ₁₃(Delay_(—) T₁₃−Delay_(—) O ₁₃)² + . . . +Q _(xy)(Delay_(—) T _(xy)−Delay_(—) O_(xy))²

In the present implementation, this equation has been rearranged to thefollowing form in order to make the location processing code moreefficient:

LSD=Σ(TDOA _(0i)−τ_(i)+τ₀)² w _(i) ²; over all i=1 to N−1

where

N=number of SCS/antennas used in the location processing;

TDOA_(0i)=the TDOA to the i^(th) site from reference site 0;

τ_(i)=the theoretical line of sight propagation time from the wirelesstransmitter to the i^(th) site;

τ₀=the theoretical line of sight propagation time from the transmitterto the reference; and

w_(i)=the weight, or quality factor, applied to the i^(th) baseline.

In the present implementation, the Wireless Location System also usesanother alternate form of the equation that can aid in determininglocation solutions when the reference signal is not very strong or whenit is likely that a bias would exist in the location solution using theprior form of the equation:

LSD′=Σ(TDOA _(0i)−τ_(i))² w _(i) ² −b ² Σw _(i) ²; over all i=0 to N−1

Where

N=number of SCS/antennas used in the location processing;

TDOA_(0i)=the TDOA to the i^(th) site from reference site 0;

TDOA₀₀=is assumed to be zero;

τ_(i)=the theoretical line of sight propagation time from the wirelesstransmitter to the i^(th) site;

b=a bias that is separately calculated for each theoretical point thatminimizes LSD′ at that theoretical point; and

w_(i)=the weight, or quality factor, applied to the i^(th) baseline.

The LSD′ form of the equation offers an easier means of removing a biasin location solutions at the reference site by making w₀ equal to themaximum value of the other weights or basing w₀ on the relative signalstrength at the reference site. Note that if w₀ is much larger than theother weights, then b is approximately equal to τ₀. In general, theweights, or quality factors are based on similar criteria to thatdiscussed above for the threshold criteria in including baselines. Thatis, the results of the criteria calculations are used for weights andwhen the criteria falls below threshold the weight is then set to zeroand is effectively not included in the determination of the finallocation solution.

Antenna Selection Process for Location Processing

Previous inventions and disclosures, such as those listed above, havedescribed techniques in which a first, second, or possibly third antennasite, cell site, or base station are required to determine location.U.S. Pat. No. 5,608,410 further discloses a Dynamic Selection Subsystem(DSS) that is responsible for determining which data frames from whichantenna site locations will be used to calculate the location of aresponsive transmitter. In the DSS, if data frames are received frommore than a threshold number of sites, the DSS determines which arecandidates for retention or exclusion, and then dynamically organizesdata frames for location processing. The DSS prefers to use more thanthe minimum number of antenna sites so that the solution isover-determined. Additionally, the DSS assures that all transmissionsused in the location processing were received from the same transmitterand from the same transmission.

The preferred embodiments of the prior inventions had severallimitations, however. First, either only one antenna per antenna site(or cell site) is used, or the data from two or four diversity antennaswere first combined at the antenna site (or cell site) prior totransmission to the central site. Additionally, all antenna sites thatreceived the transmission sent data frames to the central site, even ifthe DSS later discarded the data frames. Thus, some communicationsbandwidth may have been wasted sending data that was not used.

The present inventors have determined that while a minimum of two orthree sites are required in order determine location, the actualselection of antennas and SCS's 10 to use in location processing canhave a significant effect on the results of the location processing. Inaddition, it is advantageous to include the means to use more than oneantenna at each SCS 10 in the location processing. The reason for usingdata from multiple antennas at a cell site independently in the locationprocessing is that the signal received at each antenna is uniquelyaffected by multipath, fading, and other disturbances. It is well knownin the field that when two antennas are separated in distance by morethan one wavelength, then each antenna will receive the signal on anindependent path. Therefore, there is frequently additional and uniqueinformation to be gained about the location of the wireless transmitterby using multiple antennas, and the ability of the Wireless LocationSystem to mitigate multipath is enhanced accordingly.

It is therefore an object of the present invention to provide animproved method for using the signals received from more than oneantenna at an SCS 10 in the location processing. It is a further objectto provide a method to improve the dynamic process used to select thecooperating antennas and SCS's 10 used in the location processing. Thefirst object is achieved by providing means within the SCS 10 to selectand use any segment of data collected from any number of antennas at anSCS in the location processing. As described earlier, each antenna at acell site is connected to a receiver internal to the SCS 10. Eachreceiver converts signals received from the antenna into a digital form,and then stores the digitized signals temporarily in a memory in thereceiver. The TLP 12 has been provided with means to direct any SCS 10to retrieve segments of data from the temporary memory of any receiver,and to provide the data for use in location processing. The secondobject is achieved by providing means within the Wireless LocationSystem to monitor a large number of antennas for reception of thetransmission that the Wireless Location System desires to locate, andthen selecting a smaller set of antennas for use in location processingbased upon a predetermined set of parameters.

One example of this selection process is represented by the flowchart ofFIG. 8:

a wireless transmitter initiates a transmission on either a controlchannel or a voice channel (step S90);

the transmission is received at multiple antennas and at multiple SCS's10 in the Wireless Location System (step S91);

the transmission is converted into a digital format in the receiverconnected to each antenna (step S92);

the digital data is stored in a memory in each SCS 10 (step S93);

the transmission is demodulated at at least one SCS 10A and the channelnumber on which the transmission occurred and the cell site and sectorserving the wireless transmitter is determined (step S94);

based upon the serving cell site and sector, one SCS 10A is designatedas the ‘primary’ SCS 10 for processing that transmission (step S95);

the primary SCS 10A determines a timestamp associated with thedemodulated data (step S96);

the Wireless Location System determines whether to begin locationprocessing for the transmission (step S97);

if location processing is triggered, the Wireless Location Systemdetermines a candidate list of SCS's 10 and antennas to use in thelocation processing (step S98);

each candidate SCS/antenna measures and reports several parameters inthe channel number of the transmission and at the time of the timestampdetermined by the primary SCS 10A (step S99);

the Wireless Location System orders the candidate SCS/antennas usingspecified criteria and selects a reference SCS/antenna and a processinglist of SCS/antennas to use in the location processing (step S100); and

the Wireless Location System proceeds with location processing asdescribed earlier, using data from the processing list of SCS/antennas(step S101).

Selecting Primary SCS/Antenna

The process for choosing the ‘primary’ SCS/antenna is critical, becausethe candidate list of SCS's 10 and antennas 10-1 is determined in partbased upon the designation of the primary SCS/antenna. When a wirelesstransmitter makes a transmission on a particular RF channel, thetransmission frequently can propagate many miles before the signalattenuates below a level at which it can be demodulated. Therefore,there are frequently many SCS/antennas capable of demodulating thesignal. This especially occurs is urban and suburban areas where thefrequency re-use pattern of many wireless communications systems can bequite dense. For example, because of the high usage rate of wireless andthe dense cell site spacing, the present inventors have tested wirelesscommunications systems in which the same RF control channel and digitalcolor code were used on cell sites spaced about one mile apart. Becausethe Wireless Location System is independently demodulating thesetransmissions, the Wireless Location System frequently can demodulatethe same transmission at two, three, or more separate SCS/antennas. TheWireless Location System detects that the same transmission has beendemodulated multiple times at multiple SCS/antennas when the WirelessLocation System receives multiple demodulated data frames sent fromdifferent SCS/antennas, each with a number of bit errors below apredetermined bit error threshold, and with the demodulated datamatching within an acceptable limit of bit errors, and all occurringwithin a predetermined interval of time.

When the Wireless Location System detects demodulated data from multipleSCS/antennas, it examines the following parameters to determine whichSCS/antenna may be designated the primary SCS: average SNR over thetransmission interval used for location processing, the variance in theSNR over the same interval, correlation of the beginning of the receivedtransmission against a pure pre-cursor (i.e. for AMPS, the dotting andBarker code), the number of bit errors in the demodulated data, and themagnitude and rate of change of the SNR from just before the on-set ofthe transmission to the on-set of the transmission, as well as othersimilar parameters. The average SNR is typically determined at eachSCS/antenna either over the entire length of the transmission to be usedfor location processing, or over a shorter interval. The average SNRover the shorter interval can be determined by performing a correlationwith the dotting sequence and/or Barker code and/or sync word, dependingon the particular air interface protocol, and over a short range of timebefore, during, and after the timestamp reported by each SCS 10. Thetime range may typically be +/−200 microseconds centered at thetimestamp, for example. The Wireless Location System will generallyorder the SCS/antennas using the following criteria, each of which maybe weighted (multiplied by an appropriate factor) when combining thecriteria to determine the final decision: SCS/antennas with a lowernumber of bit errors are preferred to SCS/antennas with a higher numberof bit errors, average SNR for a given SCS/antenna must be greater thana predetermined threshold to be designated as the primary; SCS/antennaswith higher average SNR are preferred over those with lower average SNR;SCS/antennas with lower SNR variance are preferred to those with higherSNR variance; and SCS/antennas with a faster SNR rate of change at theon-set of the transmission are preferred to those with a slower rate ofchange. The weighting applied to each of these criteria may be adjustedby the operator of the Wireless Location System to suit the particulardesign of each system.

The candidate list of SCS's 10 and antennas 10-1 are selected using apredetermined set of criteria based, for example, upon knowledge of thetypes of cell sites, types of antennas at the cell sites, geometry ofthe antennas, and a weighting factor that weights certain antennas morethan other antennas. The weighting factor takes into account knowledgeof the terrain in which the Wireless Location System is operating, pastempirical data on the contribution of each antenna has made to goodlocation estimates, and other factors that may be specific to eachdifferent WLS installation. In one embodiment, for example, the WirelessLocation System may select the candidate list to include all SCS's 10 upto a maximum number of sites (max_number_of_sites) that are closer thana predefined maximum radius from the primary site(max_radius_from_primary). For example, in an urban or suburbanenvironment, wherein there may be a large number of cell sites, themax_number_of_sites may be limited to nineteen. Nineteen sites wouldinclude the primary, the first ring of six sites surrounding the primary(assuming a classic hexagonal distribution of cell sites), and the nextring of twelve sites surrounding the first ring. This is depicted inFIG. 9. In another embodiment, in a suburban or rural environment,max_radius_from_primary may be set to 40 miles to ensure that the widestpossible set of candidate SCS/antennas is available. The WirelessLocation System is provided with means to limit the total number ofcandidate SCS's 10 to a maximum number (max_number_candidates), althougheach candidate SCS may be permitted to choose the best port from amongits available antennas. This limits the maximum time spent by theWireless Location System processing a particular location.Max_number_candidates may be set to thirty-two, for example, which meansthat in a typical three sector wireless communications system withdiversity, up to 32*6=192 total antennas could be considered forlocation processing for a particular transmission. In order to limit thetime spent processing a particular location, the Wireless LocationSystem is provided with means to limit the number of antennas used inthe location processing to max_number_antennas_processed.Max_number_antennas_processed is generally less thanmax_number_candidates, and is typically set to sixteen.

While the Wireless Location System is provided with the ability todynamically determine the candidate list of SCS's 10 and antennas basedupon the predetermined set of criteria described above, the WirelessLocation System can also store a fixed candidate list in a table. Thus,for each cell site and sector in the wireless communications system, theWireless Location System has a separate table that defines the candidatelist of SCS's 10 and antennas 10-1 to use whenever a wirelesstransmitter initiates a transmission in that cell site and sector.Rather than dynamically choose the candidate SCS/antennas each time alocation request is triggered, the Wireless Location System reads thecandidate list directly from the table when location processing isinitiated.

In general, a large number of candidate SCS's 10 is chosen to providethe Wireless Location System with sufficient opportunity and ability tomeasure and mitigate multipath. On any given transmission, any one ormore particular antennas at one or more SCS's 10 may receive signalsthat have been affected to varying degrees by multipath. Therefore, itis advantageous to provide this means within the Wireless LocationSystem to dynamically select a set of antennas which may have receivedless multipath than other antennas. The Wireless Location System usesvarious techniques to mitigate as much multipath as possible from anyreceived signal; however it is frequently prudent to choose a set ofantennas that contain the least amount of multipath.

Choosing Reference and Cooperating SCS/Antennas

In choosing the set of SCS/antennas to use in location processing, theWireless Location System orders the candidate SCS/antennas using severalcriteria, including for example: average SNR over the transmissioninterval used for location processing, the variance in the SNR over thesame interval, correlation of the beginning of the received transmissionagainst a pure pre-cursor (i.e. for AMPS, the dotting and Barker code)and/or demodulated data from the primary SCS/antenna, the time of theon-set of the transmission relative to the on-set reported at theSCS/antenna at which the transmission was demodulated, and the magnitudeand rate of change of the SNR from just before the on-set of thetransmission to the on-set of the transmission, as well as other similarparameters. The average SNR is typically determined at each SCS, and foreach antenna in the candidate list either over the entire length of thetransmission to be used for location processing, or over a shorterinterval. The average SNR over the shorter interval can be determined byperforming a correlation with the dotting sequence and/or Barker codeand/or sync word, depending on the particular air interface protocol,and over a short range of time before, during, and after the timestampreported by the primary SCS 10. The time range may typically be +/−200microseconds centered at the timestamp, for example. The WirelessLocation System will generally order the candidate SCS/antennas usingthe following criteria, each of which may be weighted when combining thecriteria to determine the final decision: average SNR for a givenSCS/antenna must be greater than a predetermined threshold to be used inlocation processing; SCS/antennas with higher average SNR are preferredover those with lower average SNR; SCS/antennas with lower SNR varianceare preferred to those with higher SNR variance; SCS/antennas with anon-set closer to the on-set reported by the demodulating SCS/antenna arepreferred to those with an on-set more distant in time; SCS/antennaswith a faster SNR rate of change are preferred to those with a slowerrate of change; SCS/antennas with lower incremental weighted GDOP arepreferred over those with higher incremental weighted GDOP, wherein theweighting is based upon estimated path loss from the primary SCS. Theweighting applied to each of these preferences may be adjusted by theoperator of the Wireless Location System to suit the particular designof each system. The number of different SCS's 10 used in the locationprocessing is maximized up to a predetermined limit; the number ofantennas used at each SCS 10 in limited to a predetermined limit; andthe total number of SCS/antennas used is limited tomax_number_antennas_processed. The SCS/antenna with the highest rankingusing the above described process is designated as the referenceSCS/antenna for location processing.

Best Port Selection Within an SCS 10

Frequently, the SCS/antennas in the candidate list or in the list to usein location processing will include only one or two antennas at aparticular SCS 10. In these cases, the Wireless Location System maypermit the SCS 10 to choose the “best port” from all or some of theantennas at the particular SCS 10. For example, if the Wireless LocationSystem chooses to use only one antenna at a first SCS 10, then the firstSCS 10 may select the best antenna port from the typical six antennaports that are connected to that SCS 10, or it may choose the bestantenna port from among the two antenna ports of just one sector of thecell site. The best antenna port is chosen by using the same process andcomparing the same parameters as described above for choosing the set ofSCS/antennas to use in location processing, except that all of theantennas being considered for best port are all in the same SCS 10. Incomparing antennas for best port, the SCS 10 may also optionally dividethe received signal into segments, and then measure the SNR separatelyin each segment of the received signal. Then, the SCS 10 can optionallychoose the best antenna port with highest SNR either by (i) using theantenna port with the most segments with the highest SNR, (ii) averagingthe SNR in all segments and using the antenna port with the highestaverage SNR, or (iii) using the antenna port with the highest SNR in anyone segment.

Detection and Recovery From Collisions

Because the Wireless Location System will use data from many SCS/antennaports in location processing, there is a chance that the received signalat one or more particular SCS/antenna ports contains energy that isco-channel interference from another wireless transmitter (i.e. apartial or full collision between two separate wireless transmissionshas occurred). There is also a reasonable probability that theco-channel interference has a much higher SNR than the signal from thetarget wireless transmitter, and if not detected by the WirelessLocation System, the co-channel interference may cause an incorrectchoice of best antenna port at an SCS 10, reference SCS/antenna,candidate SCS/antenna, or SCS/antenna to be used in location processing.The co-channel interference may also cause poor TDOA and FDOA results,leading to a failed or poor location estimate. The probability ofcollision increases with the density of cell sites in the host wirelesscommunications system, especially in dense suburban or ruralenvironments where the frequencies are re-used often and wireless usageby subscribers is high.

Therefore, the Wireless Location System includes means to detect andrecover from the types of collisions described above. For example, inthe process of selecting a best port, reference SCS/antenna, orcandidate SCS/antenna, the Wireless Location System determines theaverage SNR of the received signal and the variance of the SNR over theinterval of the transmission; when the variance of the SNR is above apredetermined threshold, the Wireless Location System assigns aprobability that a collision has occurred. If the signal received at anSCS/antenna has increased or decreased its SNR in a single step, and byan amount greater than a predetermined threshold, the Wireless LocationSystem assigns a probability that a collision has occurred. Further, ifthe average SNR of the signal received at a remote SCS is greater thanthe average SNR that would be predicted by a propagation model, giventhe cell site at which the wireless transmitter initiated itstransmission and the known transmit power levels and antenna patterns ofthe transmitter and receive antennas, the Wireless Location Systemassigns a probability that a collision has occurred. If the probabilitythat a collision has occurred is above a predetermined threshold, thenthe Wireless Location System performs the further processing describedbelow to verify whether and to what extent a collision may have impairedthe received signal at an SCS/antenna. The advantage of assigningprobabilities is to reduce or eliminate extra processing for themajority of transmissions for which collisions have not occurred. Itshould be noted that the threshold levels, assigned probabilities, andother details of the collision detection and recovery processesdescribed herein are configurable, i.e., selected based on theparticular application, environment, system variables, etc., that wouldaffect their selection.

For received transmissions at an SCS/antenna for which the probabilityof a collision is above the predetermined threshold and before using RFdata from a particular antenna port in a reference SCS/antennadetermination, best port determination or in location processing, theWireless Location System preferably verifies that the RF data from eachantenna port is from the correct wireless transmitter. This isdetermined, for example, by demodulating segments of the received signalto verify, for example, that the MIN, MSID, or other identifyinginformation is correct or that the dialed digits or other messagecharacteristics match those received by the SCS/antenna that initiallydemodulated the transmission. The Wireless Location System may alsocorrelate a short segment of the received signal at an antenna port withthe signal received at the primary SCS 10 to verify that the correlationresult is above a predetermined threshold. If the Wireless LocationSystem detects that the variance in the SNR over the entire length ofthe transmission is above a predetermined threshold, the WirelessLocation System may divide the transmission into segments and test eachsegment as described herein to determine whether the energy in thatsegment is primarily from the signal from the wireless transmitter forwhich location processing has been selected or from an interferingtransmitter.

The Wireless Location System may choose to use the RF data from aparticular SCS/antenna in location processing even if the WirelessLocation System has detected that a partial collision has occurred atthat SCS/antenna. In these cases, the SCS 10 uses the means describedabove to identify that portion of the received transmission whichrepresents a signal from the wireless transmitter for which locationprocessing has been selected, and that portion of the receivedtransmission which contains co-channel interference. The WirelessLocation System may command the SCS 10 to send or use only selectedsegments of the received transmission that do not contain the co-channelinterference. When determining the TDOA and FDOA for a baseline usingonly selected segments from an SCS/antenna, the Wireless Location Systemuses only the corresponding segments of the transmission as received atthe reference SCS/antenna. The Wireless Location System may continue touse all segments for baselines in which no collisions were detected. Inmany cases, the Wireless Location System is able to complete locationprocessing and achieve an acceptable location error using only a portionof the transmission. This inventive ability to select the appropriatesubset of the received transmission and perform location processing on asegment by segment basis enables the Wireless Location System tosuccessfully complete location processing in cases that might havefailed using previous techniques.

Multiple Pass Location Processing

Certain applications may require a very fast estimate of the generallocation of a wireless transmitter, followed by a more accurate estimateof the location that can be sent subsequently. This can be valuable, forexample, for E9-1-1 systems that handle wireless calls and must make acall routing decision very quickly, but can wait a little longer for amore exact location to be displayed upon the E9-1-1 call-taker'selectronic map terminal. The Wireless Location System supports theseapplications with an inventive multiple pass location processing mode.

In many cases, location accuracy is enhanced by using longer segments ofthe transmission and increasing the processing gain through longerintegration intervals. But longer segments of the transmission requirelonger processing periods in the SCS 10 and TLP 12, as well as longertime periods for transmitting the RF data across the communicationsinterface from the SCS 10 to the TLP 12. Therefore, the WirelessLocation System includes means to identify those transmissions thatrequire a fast but rough estimate of the location followed by morecomplete location processing that produces a better location estimate.The Signal of Interest Table includes a flag for each Signal of Interestthat requires a multiple pass location approach. This flag specifies themaximum amount of time permitted by the requesting location applicationfor the first estimate to be sent, as well as the maximum amount of timepermitted by the requesting location application for the final locationestimate to be sent. The Wireless Location System performs the roughlocation estimate by selecting a subset of the transmission for which toperform location processing. The Wireless Location System may choose,for example, the segment that was identified at the primary SCS/antennawith the highest average SNR. After the rough location estimate has beendetermined, using the methods described earlier, but with only a subsetof the transmission, the TLP 12 forwards the location estimate to the AP14, which then forwards the rough estimate to the requesting applicationwith a flag indicating that the estimate is only rough. The WirelessLocation System then performs its standard location processing using allof the aforementioned methods, and forwards this location estimate witha flag indicating the final status of this location estimate. TheWireless Location System may perform the rough location estimate and thefinal location estimate sequentially on the same DSP in a TLP 12, or mayperform the location processing in parallel on different DSP's. Parallelprocessing may be necessary to meet the maximum time requirements of therequesting location applications. The Wireless Location System supportsdifferent maximum time requirements from different location applicationsfor the same wireless transmission.

Very Short Baseline TDOA

The Wireless Location System is designed to operate in urban, suburban,and rural areas. In rural areas, when there are not sufficient cellsites available from a single wireless carrier, the Wireless LocationSystem can be deployed with SCS's 10 located at the cell sites of otherwireless carriers or at other types of towers, including AM or FM radiostation, paging, and two-way wireless towers. In these cases, ratherthan sharing the existing antennas of the wireless carrier, the WirelessLocation System may require the installation of appropriate antennas,filters, and low noise amplifiers to match the frequency band of thewireless transmitters of interest to be located. For example, an AMradio station tower may require the addition of 800 MHz antennas tolocate cellular band transmitters. There may be cases, however, whereinno additional towers of any type are available at reasonable cost andthe Wireless Location System must be deployed on just a few towers ofthe wireless carrier. In these cases, the Wireless Location Systemsupports an antenna mode known as very short baseline TDOA. This antennamode becomes active when additional antennas are installed on a singlecell site tower, whereby the antennas are placed at a distance of lessthan one wavelength apart. This may require the addition of just oneantenna per cell site sector such that the Wireless Location System usesone existing receive antenna in a sector and one additional antenna thathas been placed next to the existing receive antenna. Typically, the twoantennas in the sector are oriented such that the primary axes, or lineof direction, of the main beams are parallel and the spacing between thetwo antenna elements is known with precision. In addition, the two RFpaths from the antenna elements to the receivers in the SCS 10 arecalibrated.

In its normal mode, the Wireless Location System determines the TDOA andFDOA for pairs of antenna that are separated by many wavelengths. For aTDOA on a baseline using antennas from two difference cell sites, thepairs of antennas are separated by thousands of wavelengths. For a TDOAon a baseline using antennas at the same cell site, the pairs ofantennas are separated by tens of wavelengths. In either case, the TDOAdetermination effectively results in a hyperbolic line bisecting thebaseline and passing through the location of the wireless transmitter.When antennas are separated by multiple wavelengths, the received signalhas taken independent paths from the wireless transmitter to eachantenna, including experiencing different multipath and Doppler shifts.However, when two antennas are closer than one wavelength, the tworeceived signals have taken essentially the same path and experiencedthe same fading, multipath, and Doppler shift. Therefore, the TDOA andFDOA processing of the Wireless Location System typically produces aDoppler shift of zero (or near-zero) hertz, and a time difference on theorder of zero to one nanosecond. A time difference that short isequivalent to an unambiguous phase difference between the signalsreceived at the two antennas on the very short baseline. For example, at834 MHz, the wavelength of an AMPS reverse control channel transmissionis about 1.18 feet. A time difference of 0.1 nanoseconds is equivalentto a received phase difference of about 30 degrees. In this case, theTDOA measurement produces a hyperbola that is essentially a straightline, still passing through the location of the wireless transmitter,and in a direction that is rotated 30 degrees from the direction of theparallel lines formed by the two antennas on the very short baseline.When the results of this very short baseline TDOA at the single cellsite are combined with a TDOA measurement on a baseline between two cellsites, the Wireless Location System can determine a location estimateusing only two cell sites.

Monitoring of Call Information

Overview

A network-based WLS uses geographically separated receivers to listenfor signals from a roving transmitter. In a wireless communicationsnetwork, the roving transmitter, in this case a wireless phone, can bebroadcasting on any one of potentially thousands of control or trafficchannels. A mechanism is needed for collecting this channel and callerinformation. We will now describe the subject invention, which providesa mechanism for communicating with the wireless system with minimalimpact to the existing system by passively monitoring a specific linkfor cell ID, timing advance or PN offset, frequency, caller informationand other information specific to a subscriber. (This is alluded toabove in connection with the description of the AP—see the subsectiontitled “Monitor Internal Wireless Communications System Interfaces,State Table.”) The specific link, e.g., may be the BSC-BTS link calledthe “Abis” link in GSM and other names by various manufacturers forother radio access system (AMPS, CDMA, TDMA, PDC, J-CDMA, CDMAOne,CDMA2000, W-CDMA, etc.). This information obtained from the link ispassed to a TDOA, AOA, or hybrid TDOA/AOA -based location system thatuses the information to acquire and process wireless phone signals forthe purposes of location estimation.

FIG. 10 schematically depicts a system in which a Base Transceiver Site(BTS) 10-1 is coupled to a Base Station Controller (BSC) 10-3 by way ofan Abis interface. As shown, an Abis monitor 10-2 is coupled to the Abisinterface. This aspect of the present invention is described in greaterdetail below. FIG. 10 further depicts a Mobile Switching Center (MSC)10-4 coupled to the BSC via an “A interface”, as well as a VisitorLocation Register (VLR) 10-5 and Home Location Register (HLR) 10-6. TheBTS, BSC, MSC, VLR and HLR are well known components of a GSM wirelesscommunications system.

The present invention, in a presently preferred implementation, providesa mobile station (MS) management method for a WLS that is overlaid on atleast a portion of a wireless communications system. The wirelesscommunications system, as indicated above, includes BTS equipmentconnected to BSC equipment. The inventive method is generallyillustrated by the flowchart of FIG. 11, and involves:

monitoring the communications between at least one BTS and at least oneBSC (step S110);

extracting MS information from the monitored communications (step S112);

forwarding the extracted MS information to the WLS (step S114);

the WLS may then use the extracted MS information for a variety ofpurposes (step S116), which are outlined below.

The extracted MS information may include the mobile stationidentification (MSID), the called number dialed by the user of the MS,the contents of messages sent to the MS or from the MS, or frequencyassignment information sent to the MS. In addition, the extracted MSinformation may include any of the following presently in use by the MS:the control channel, the traffic channel, the mobile directory number(MDN), the Electronic Serial Number (ESN), the Mobile Identity Number(MIN), the Mobile Subscriber Identification (MSI), the internationalmobile subscriber identity (IMSI), the temporary mobile subscriberidentity (IMSI), or the mobile station international ISDN number(MSISDN).

As mentioned, there are a number of different uses for the extractedinformation. First, the WLS may use the extracted information todetermine whether to perform location processing for the MS, or todetermine which radio resources to use in performing location processingfor the MS. In addition, the WLS may store the extracted MS informationin a database for use at a later time or by other applications.Preferably, the WLS will remove the extracted MS information from thedatabase after it is no longer valid. For example, the extracted MSinformation may be determined to be no longer valid because the MS is nolonger registered with the wireless communications system, because apredetermined period of time has expired, because a predetermined periodof time has expired without an update to the extracted MS information,or because the extracted MS information does not match any of a set ofpredetermined criteria. The set of predetermined criteria may includeinformation about the identity of the MS or the number called by theuser of the MS.

Detailed Description of Exemplary Embodiment for Abis Monitoring

1. Introduction

A method to employ a location system of the kind described above tolocate GSM mobile phones will now be described. With the architecturedescribed herein, the WLS would not be required to detect and demodulatemessages from the mobile terminal during call setup. Instead, thelocation system would derive call setup information from the Abisinterface between the BTS and the BSC. From the Abis interface, thelocation system can identify the calling party (indirectly), the calledparty (i.e., 911), and the TDMA/FDMA resource that is being used for agiven call at any time. In the following sections, an overview of callsetup in a GSM system will be presented, including relevant messages andformats. Next, an exemplary architecture for identifying and locatingcalls in a GSM system is presented, followed by the high level subsystemfeatures used to locate GSM calls.

2. Mobile Originated Call Setup in a GSM System

2.1. Call Setup—Early Stages

The following discussion assumes that the mobile station (MS) is in thestate of being “normally registered” with the network. An overview ofthe transactions involved in call setup emphasizing the function of thedifferent protocol layers is presented in FIG. 12A. It should beunderstood that some of the layers are completely internal to onephysical subsystem, e.g., the MS, and are used more for conceptualclarification.

2.1.1 Channel Request

When the MS desires to originate a call, presumably a “911” call, the CClayer in the handset presents a request to the MM layer therein, whichin turn asks the Radio Resource (RR) layer, or Layer 3, to request aradio connection. This is depicted in the top flow line of FIG. 12A.This request is transparent to the link layer (Layer 2) and is simplyviewed by it as a “data indication” to be transported to higher layers.

This channel request on the physical layer (Layer 1), however, has aunique format. It uses the “Access Burst” which is a shorter burst thanthe regular burst. The access burst consists of 87 channel bits, ratherthan the regular 147 bits, with the remainder as guard time. The MSneeds the extra guard time because time advance as measured and providedto the MS by the BTS is not available on the very first instance ofrandom access.

The channel request message consists of only 8 information bits. Theseare then coded with a combination of a rate ½ convolutional code and a6-parity-bits cyclic code to yield a 36-bit block. This, in turn, isaugmented with a 41 bit unique training sequence, and tail bits in thebeginning and the end to create the 87-bit access burst shown in FIG.12B.

The 8 information bits in the RR layer channel request message take theform shown in FIG. 12C. The coding scheme for the Channel Requestmessage is defined in paragraph 4.6 of GSM 05.03.

The random reference is an unformatted field of variable length betweentwo and five bits long. It is used to distinguish responses from the BTSto mobiles that may have requested radio channels simultaneously. TheEstablishment Cause field is also of variable length, between 3 and 6bits long, with the generic cause of requesting a radio link. Some ofthe bit sequences of particular interest in this field are shown inTable 2-1, below.

TABLE 2-1 Some of the Channel Request Causes and their Bit Sequences(see Section 9.1.8/GSM 04.08) Message Establishment Cause 101xxxxxEmergency call 111xxxxx Originating call and TCH/F (full rate trafficchannel) needed, etc. 0000xxxx Location Updating 110xxxxx Callre-establishment, etc. 100xxxxx, 0010xxxx Answers to paging 0011xxxx,0001xxxx . . . Others

As can be seen, an emergency call, whatever that is defined to be by thecarrier, and whatever the handset software implements accordingly, has aunique bit pattern that could be detected. The channel request isdemodulated in the BTS and passed on, in a transparent manner, via aLayer 2 “data indication” to the BSC, as a Channel Required message. Theformat of Channel Required message is shown in Table 2-2.

TABLE 2-2 Channel Required Message on the Abis Interface (Section8.5.3/GSM 08.58) INFORMATION REFERENCE PRESENCE FORMAT LENGTH ELEMENTMessage 9.1 M V 1 discriminator Message type 9.2 M V 1 Channel number9.3.1 M TV 2 Request 9.3.19 M TV 4 Reference Access Delay 9.3.17 M TV 2Physical Context 9.3.16 O 1) TLV > = 2 1) Optional element foradditional physical channel information.

The most interesting fields here are those of the Request Reference.These are shown in more detail in FIG. 12D. The RA octet is the keyinformation octet sent by the MS in the Channel Request and wouldcontain the random identifier and the establishment cause, e.g., bitpattern 101 for 911. The other octets contain the coding of the absoluteframe number modulo 42432 in which the access burst was received.

The other contents of the Channel Required message on the Abis Interfaceare the access delay measured by the BTS (on the access burst), and thechannel number. The frame number and access delay can be used by thelocation system to determine the frame epoch relative to GPS time, aswill be explained later. All of the useful information provided by theChannel Request message on the air interface can be obtained from theRequest Reference field of the Channel Required message on the Abisinterface.

2.1.2 Immediate Assignment

Once the Channel Required message is received and processed by the BSC,it responds by activating the appropriate transceiver at the BTS tocarry the SDCCH signaling channel. This is performed via the ChannelActivation command. The Channel Activation command has the format andcontents shown in Table 2-3 below.

The mandatory information in the Channel Activation command includes theChannel Number, the Activation Type, and the Channel Mode. Theactivation type specifies whether it is an immediate assignment or anormal assignment, a handoff, or an additional assignment (e.g., formulti-slot operation). The channel mode is of variable length andcontains detailed information on the mode of the channel, i.e., speech,data or signaling, its rate, speech coding algorithm, and DTX on or off.

Another information element in the Channel Activation command is theEncryption Information. This information is included only if cipheringis to be applied by the BTS, hence would be normally included in thecommand. The encryption information element is depicted in FIG. 12F. Notonly does it include the algorithm but also the key (K_(c)) to be usedfor the ciphering and deciphering operations.

More information to the radio devices is provided in the ChannelActivation command, including BS and MS power settings and parameters,and the timing advance.

When the BSC receives a positive acknowledgement from the BTS via theChannel Activation Acknowledge message it sends the Immediate AssignCommand to the BTS. This is used by the BTS to create the ImmediateAssignment message, which is scheduled for transmission by the BTS. TheImmediate Assign Command on the Abis Interface contains the completeradio definition of the physical signaling channel assigned.

TABLE 2-3 Channel Activation Command on the Abis Interface INFORMATIONELEMENT REFERENCE PRESENCE FORMAT LENGTH Message 9.1 M V 1 discriminatorMessage type 9.2 M V 1 Channel number 9.3.1 M TV 2 Activation Type 9.3.3M TV 2 Channel Mode 9.3.6 M TLV 8-9 Channel Identi- 9.3.5 O 7) TLV 8fication Encryption 9.3.7 O 1) TLV > = 3 information Handover 9.3.9 C 2)TV 2 Reference BS Power 9.3.4 O 3) TV 2 MS Power 9.3.13 O 3) TV 2 TimingAdvance 9.3.24 C 3) 4) TV 2 BS Power 9.3.32 O 5) TLV > = 2 Parameters MSPower 9.3.31 O 5) TLV > = 2 Parameters Physical 9.3.16 O 6) TLV > = 2Context SACCH 9.3.29 O 8) TLV > = 3 Information UIC 9.3.50 C 9) TLV 3 1)The Encryption Information element is only included if ciphering is tobe applied. 2) The Handover Reference element is only included ifactivation type is handover. 3) If BS Power, MS Power and/or TimingAdvance elements are present, they are to be used to set the initialtransmission power and the initial L1-header. 4) The Timing Advanceelement must be included if activation type is intra cell channelchange. 5) The BS and MS Power Parameters elements are included toindicate that BS and/or MS power control is to be performed by BTS. Themaximum power to be used is indicated in the BS and MS Power elementsrespectively. 6) Optional element for additional physical channelinformation. 7) Included if compatibility with phase 1 is required.

TABLE 2-4 Channel Activation Acknowledge (Section 8.4.2/GSM 08.58)INFORMATION ELEMENT REFERENCE PRESENCE FORMAT LENGTH Message 9.1 M V 1discriminator Message type 9.2 M V 1 Channel number 9.3.1 M TV 2 Framenumber 9.3.8 M TV 3

TABLE 2-5 Immediate Assign Command on the Abis Interface INFORMATIONELEMENT REFERENCE PRESENCE FORMAT LENGTH Message 9.1 M V 1 discriminatorMessage type 9.2 M V 1 Channel number 9.3.1 M TV 2 Full Imm. Assign9.3.35 M TV 25  Info

The Immediate Assign Command also contains the Channel NumberInformation Element, as shown. The Channel Number contains the ChannelType, subchannel number, and the TN for all messages sent across theAbis interface. This allows correlation of and Abis message with the airinterface message. The BTS sends the corresponding Layer 3 ImmediateAssignment command to the MS somewhere on the CCCH. The MS needs tolisten to both the CCCH and the BCCH during that period.

The Immediate Assignment message causes the mobile to seize thededicated signaling channel on which it will exchange subsequentsignaling messages pertaining to call setup. There are two varieties inthe specification for this message. The usual Immediate Assignment, andan Immediate Assignment Extended version, which addresses simultaneouslytwo mobile stations in the same cell and provides them their dedicatedsignaling channel information.

For the purposes of this discussion, examining the Immediate Assignmentmessage will suffice. (If needed in the future, the extended messageversion can be found in the section 9.1.19/GSM 04.08.)

There are many important fields in the Immediate Assignment message. The“Immediate Assignment Message Type” field is just the octet: 00111111.(There are other patterns for assignment extended and rejected.) The3-octet request reference contains first the exact content of thechannel request and the rest enables the computation of the frame number(modulo 42432) in which the request was received. The channeldescription contains of course critical RF information.

TABLE 2-6 The Radio Resource Immediate Assignment Message to the Mobile(Section 9.1.18/GSM 04.08) Information IEI Element Reference PresenceFormat Length L2 Pseudo Length 10.5.2.19 M V 1 RR management 10.2 M V1/2 Protocol Discriminator Skip Indicator 10.3.1 M V 1/2 ImmediateAssignment 10.4 M V 1 Message Type Page Mode 10.5.2.26 M V 1/2 SpareHalf Octet 10.5.1.8 M V 1/2 Channel Description 10.5.2.5 M V 3 RequestReference 10.5.2.30 M V 3 Timing Advance 10.5.2.40 M V 1 MobileAllocation 10.5.2.21 M LV 1-9 7C Starting Time 10.5.2.38 O TV 3 IA ResetOctets 10.5.2.16 M V 0-11 (frequency parameters, before time) Notes: M =Mandatory; O = Optional; V = Value; T = Type; L = Length (octet)

In FIG. 12H, TN is the timeslot number (0 to 7), TSC is the trainingsequence (0 to 7, and H is the hopping indicator bit. If H=0, no hoppingis used and ARFCN is the Absolute Radio Frequency Channel Number codedin binary (0-1023). If H=1, then the hopping sequence is defined by MAIO(the Mobile Allocation Index Offset), and (HSN the hopping sequencenumber), which takes the values 0-63. The Mobile Allocation field andthe IA rest Octets also relate to frequency hopping.

The Channel Description information element is defined for the ImmediateAssignment message. The similarity between the Channel Description IE ofthe air interface and the Channel Number of the Abis messages allowscorrelation of Abis messages with specific physical channels on the airinterface.

The timing advance field is a binary coded representation of the advancein bit periods required of the MS according to the measurement performedat the BTS of the received random access burst. The MS transmissions arealways 3 regular burst periods behind the BTS transmission offset by thetime advance specified by the BTS. The optional starting time is againin TDMA FN units (modulo 42432). The frame is approximately 4.615 ms (8bursts).

The Immediate Assign command on the Abis Interface contains theImmediate Assign message to be transmitted on the air interface. Thus,it contains three very key information elements related to a 911 call inthe immediate assignment: the Request Reference (containing the bitpattern corresponding to emergency call), the Channel Description, andthe Mobile Allocation. This is all the information the location systemneeds to track the signaling channel used during the setup process of a911 call.

2.1.3. CM Service Request

Once the MS receives the Immediate Assignment from the BTS, it adjustsits radio and aligns its timing then transmits back to the BTS on thespecified dedicated (logical) channel the Connection Management (CM)Service Request. (That assumes, as mentioned earlier, that the MS was inthe proper registered idle state). The CM service request message issynthesized and stored in the handset when the caller initiates the callsequence.

At the link layer, the CM service request is carried inside the SABM(Set Asynchronous Balanced Mode) Layer-2 frame, which basically enablesthe exchange and acknowledgment of MS-unique information between the MSand BTS, thus avoiding any potential MS ambiguity during the randomaccess contention phase. First, the CM service request message containsimportant information that can be very useful to an E-911 locationsystem.

TABLE 2-7 Contents of the CM Service Request Message from the MS (TABLE9.45/GSM 04.08) IEI Information Element Reference Presence Format LengthMobility Management 10.2 M V 1/2 Protocol Discriminator Skip Indicator10.3.1 M V 1/2 CM Service Request 10.4 M V 1 Message Type CM ServiceType 10.5.3.3 M V 1/2 Ciphering Key 10.5.1.2 M V 1/2 Sequence NumberMobile Station 10.5.1.6 M LV 4 Classmark Mobile Identity 10.5.1.4 M LV2-9

The CM service request message type octet belongs to the family ofmobility management message types and is 0x100100. The CM Service Typehalf octet carries information that could of key importance to an E-911location system. The half byte structure and content is shown in FIG.12I.

The half octet pertaining to the ciphering key sequence number containthree bits that provide the network with one of seven possible sequencenumbers for, or a 111 pattern which indicates that no key is present inthe MS.

The MS “classmark 2” message is depicted in FIG. 12J. It carriesinformation on maximum RF power capability of the MS: The MS classmark 2message also carries information on the encryption algorithm A5/x the MSsupports (if any). The length of the message is variable and varies upto four octets total (only L and V are transmitted).

Finally, the important mobile identity fields are transmitted toconclude the CM Service request message from the MS. There are threetypes of MS identity that could be used. These are:

TMSI: Temporary Mobile Subscriber Identity;

IMSI: International Mobile Subscriber Identity; and

IMEI: International Mobile Station Equipment Identity.

Relaying this information to the network is done through the MobileIdentity fields, which can be 2 to 9 octets long, and are illustrated inFIG. 12K. The type of MS identity used is provided in octet 3.

There are certain rules in the specification on the use of the differentidentity types available. For mobile originating calls, for other than“emergency” call establishment or re-establishment the priority will befor the MS to use:

1 TMSI if available,

2. IMSI if no TMSI is available.

In the case of emergency call establishment or re-establishment, a thirdpriority is added:

3. IMEI is used if neither a TMSI nor an IMSI is available, or if thereis no SIM, or the MS does not consider the SIM valid.

The actual coding of the IMSI or IMEI can be found in the specificationin Section 10.5.1.4/GSM 04.08.

When the CM Service Request message (carried in the SABM frame) isreceived at he BTS, it is sent back to the MS without any modificationbut encapsulated inside a UA (Unnumbered acknowledgement) frame. Thistakes place on the DCCH radio channel specified earlier in the ImmediateAssignment.

The BTS simultaneously passes the CM Service Request to the BSC in an RREstablish Indication message over the Abis interface. The particulars(e.g., radio attributes) of the mobile are stored in the BTS and/or BSCfor later use. The Establishment Indication can be identified as anSDCCH message by the link Identifier. The BSC at this point establishesan SCCP (Signal Connection Control Part) connection on the A-Interfaceto the MSC. The CM Service Request message may be optionally piggybackedon the SCCP Connection Request message. It may also be sent after theSCCP connection establishment via a BSSMAP Complete Layer 3 Informationmessage.

TABLE 2-9 Establishment Indication Message Carrying the Service Requeston the Abis Interface INFORMATION ELEMENT REFERENCE PRESENCE FORMATLENGTH Message 9.1 M V 1 discriminator Message type 9.2 M V 2 Channelnumber 9.3.1 M TV 2 Link Identifier 9.3.2 M TV 2 L3 Information 9.3.11O 1) TLV 3-23 1) The L3 Information field is present only if the SABMframe contained a non-empty information field.

TABLE 2-10 Link Identifier Information Element (Section 9.3.2/GSM 08.58)8 7 6 5 4 3 2 1 Element Identifier 1 C2 C1 NA reserved SAPI 2 The C bitsindicate the channel type as follows: C2 C1 0 0 main signalling channel(FACCH or SDCCH) 0 1 SACCH The SAPI field contains the SAPI value asdefined in the Technical Specification CSM 04.05.

Now, after being informed by the BSC of the existing service request,which contains the mobile subscriber's specifics, the MSC becomesinvolved and has the information to trigger the actions in the upperlayers (MM and CC). The MSC now takes charge of the ensuingcharacteristics of the RR session and initiates the appropriate steps ofauthentication, encryption, call routing, and so on. Because the fall CMService Request message is sent across the Abis interface, the callingparty's identity can be obtained from the Abis interface.

2.2 Authentication

The previous section has dealt with the early phase of call set-up,mostly that of radio resource assignment. The protocol layers involvedare 1 through 3: physical, data link, and radio resource link. Before acall setup can go further, certain verification/security procedures needto be executed and these generally belong to the class of mobilitymanagement. This can be thought of as Layer 4 of the protocol stack.

The network may trigger the authentication of the PCS user identity whenthe user applies for:

a change of a subscriber-related information element in the VLR or HLR(including some or all of: location updating involving change of VLR,registration or erasure of a supplementary service),

an access to a service (including some or all of: set-up of mobileoriginating or terminated calls, activation or deactivation of asupplementary service), or

first network access after restart of MSC/VLR, or in the event of cipherkey sequence number mismatch.

The authentication procedure includes the following exchange between thenetwork and the MS. The Network transmits and Authentication RequestMessage. The user terminal performs some computation and replies withthe Authentication Response Message shown in Table 2-12.

TABLE 2-12 Authentication Response Message Contents IEI InformationElement Reference Presence Format Length Mobility Management 10.2 M V1/2 Protocol Discriminator Skip Indicator 10.3.1 M V 1/2 Authentication10.4 M V 1 Response Message Type Authentication 10.5.3.2 M V 4 parameterSRES

2.3 Encryption/Ciphering

Although the subscriber identity and dialed digits can be determinedfrom the Abis interface, it may be required for the location system tobe able to recreate the channel bits transmitted by the mobile terminalfor station based location processing. In order to create bitstransmitted by the mobile, the location system may need to know of theencryption algorithm, key, and synchronization. To maintain theconfidentiality of signaling and user data over the radio link, fouritems may have to be specified: encryption method; key setting; startingof the encryption and decryption processes; and synchronization. Theencryption algorithm is known as A5.

Mutual key setting is the procedure that allows the MS and the networkto agree on the key Kc to be used in the encryption and decryptionalgorithm A5. Key setting is triggered by the authentication procedure.A key setting must occur on a DCCH not yet encrypted and as soon as theidentity of the mobile user TMSI or IMSI) is known by the network.

Because of the potential inconsistencies that could exist between the“current” Kc on the MS and network sides, the parameter Ciphering KeySequence Number alluded to earlier is included in the location updaterequest and CM service request. This number is stored with the Kc, if itis found to be inconsistent upon the receipt of, say, a CM servicerequest, the MSC/VLR knows that an authentication procedure is requiredbefore ordering the ciphered mode.

Returning to the mechanics of encryption, the operation takes place justbefore modulation and after interleaving; symmetrically, the decryptiontakes place after the demodulation. The encryption and decryption startat different instances.

The ciphering and deciphering operations are performed by applying anexclusive-or operation between the 114 coded bits of a radio burst and114-bit ciphering sequences generated by A5 as depicted in FIG. 12M. Thetwo link directions use different sequences: for each burst, onesequence is used for ciphering in the MS and deciphering in the BTS,whereas another is used for ciphering at the BTS and deciphering at theMS.

The use of the frame number guarantees the required synchronization ofthe operations. For all types of radio channels the frame number changesfrom burst to burst.

Accordingly, each burst of a given communication in the same directionuses a different ciphering sequence. The successive values for the framenumber depends on the time organization of each channel and are notnecessarily consecutive.

Upon receiving the contents of the CM service request at the MSC, itinitiates the procedures of authentication and ciphering. Assumingsuccessful authentication, the MSC is now ready to start the transitionof the link to the ciphered mode. Ciphering, however, is a transmissionfunction and is performed at the BTS. The decision at the MSC thereforeresults in a cascade of commands and steps to execute the transition.This is illustrated in FIG. 12N.

The MSC sends to the BSC a BSSMAP Cipher Mode Command on the AInterface. At the BSC the cipher mode command is encapsulated in anEncryption Command on the Abis interface. This is a non-transparentcommand, which contains in addition to the cipher mode command,information on the specific radio channel and the ciphering key.

TABLE 2-13 Encryption Command on the Abis Interface INFORMATION PRES-ELEMENT REFERENCE ENCE FORMAT LENGTH Message discriminator 9.1 M V 1Message type 9.2 M V 1 Channel number 9.3.1 M TV 2 Encryption 9.3.7 MTLV >=3 information Link Identifier 9.3.2 M TV 2 L3 Info (CIPH MOD9.3.11 M TLV 6 CMD)

The BTS upon receiving this encryption command executes the A5 algorithmbut only on the receive side. It transmits to the MS in the clear theCiphering Mode Command message. The cipher mode setting contains a bitto identify if ciphering is to be used and three bits to specify one ofthe possible A5 algorithm versions. The Cipher Response half octetcontains one significant bit only; it specifies whether the MS is toinclude its identity, specifically its IMEI, in the confirmationresponse, the Ciphering Mode Complete message. The identity is includedonly if the IMEI was requested.

The MS upon receiving the Ciphering Mode Command on the DCCH, runs theA5 algorithm and starts both ciphering and deciphering. It sends backthe Ciphering Mode Complete message in the ciphered mode. When the BTSreceives this and successfully deciphers it, it turns on its cipheringfor subsequent transmissions. The BTS relays the Cipher Mode Complete asa data indication on the Abis Interface to the BSC. The BSC, in turn,translates that information into a MAPBSS Cipher Mode Complete messageon the A-Interface to the MSC.

2.4 Call Setup—Late Stages

After entering the ciphering mode at its end, the MS sends on the DCCHthat had been assigned from the beginning the call Setup message. Thismessage contains many types of information and can vary considerable insize depending on the requested service. For voice telephony (the caseof most interest for wireless location) it is simpler in content thanfor data or supplementary services. The regular call setup message willbe discussed first. There is also in the specification an “EmergencySetup” message, which is significantly simpler. It will be describedafter the more general one. The location system needs to be able tohandle both cases.

The structure of the regular setup message is provided in Table 2-14.The first category of information in the setup command pertains to thebearer service capability (voice at what rate, speech coding of whatversion, radio channel requirement, data or fax at what rate,synchronous data or not, transcoding, and so and so forth.) Thisinformation is contained in the fields called bearer Capability 1 and 2.At least one such field is mandatory. The MS needs to specify all voicerates and versions it is capable of supporting.

TABLE 2-14 Setup Message for Mobile Originating Call (Table 9.70a/GSM04.08) Pres- IEI Information Element Reference ence Format Length CallControl Protocol 10.2 M V 1/2 Discriminator Transaction Identifier10.3.2 M V 1/2 Setup Message Type 10.4 M V 1 D- BC Repeat Indicator10.5.4.22 C TV 1 04 Bearer Capability 1 10.5.4.5 M TLV 3-10 04 BearerCapability 2 10.5.4.5 O TLV 3-10 1C Facility 10.5.4.15 O TLV 2-? 5DCalling Party Sub-address 10.5.4.10 O TLV 2-23 5E Called Party BCDNumber 10.5.4.7 M TLV 3-13 6D Called Party Sub-address 10.5.4.8 O TLV2-23 D- LLC Repeat Indicator 10.5.4.22 O TV 1 7C Low Layer CompatibilityI 10.5.4.18 O TLV 2-15 7C Low Layer Compatibility II 10.5.4.18 O TLV2-15 D- HLC Repeat Indicator 10.5.4.22 O TV 1 7D High LayerCompatibility I 10.5.4.16 O TLV 2-5 7D High Layer Compatibility II10.5.4.16 O TLV 2-5 7E User-user 10.5.4.25 O TLV 3-35 7F SS Version10.5.4.24 O TLV 2-3 A1 CLIR Suppression 10.5.4.11a C T 1 A2 CLIRInvocation 10.5.4.11b O T 1

Since the TMSI (or IMSI) has been sent earlier to the network, thecalling party BCD number is optional. The called party BCD number ismandatory. It is the very first time from the beginning of the RR setupprocedure that this information has been divulged. The called BCD numberis 3 to 19 octets long; its structure is depicted in FIG. 12P. A calledparty subaddress field could also be included but not usually for voice;it varies in length between 2 and 23 octets. The other optional fieldsin the setup message pertain to whether the MS would like to provideadditional compatibility information for the lower layers, e.g., as withsome possible data or supplementary services. These will likely bemissing in a voice call setup.

The “Emergency Setup” message has the structure shown in Table 2-15.Obviously it does away with much unnecessary information in the case ofan emergency (911) call. There are no called and calling number fields.The bearer capability is, however, included and indicates speech withthe appropriate version(s) the MS supports, and the appropriate value inthe radio channel requirement field. This emergency setup message canhave an overall length of as little as 5 octets and as long as 12.

TABLE 2-15 Emergency Call Setup message Content (Section 9.3.8/GSM04.08) Pres- IEI Information Element Reference ence Format Length CallControl Protocol 10.2 M V 1/2 Discriminator Transaction Identifier10.3.2 M V 1/2 Emergency Setup Message 10.4 M V 1 Type 04 BearerCapability 10.5.4.5 O TLV 3-10

The setup message is received by the BTS and forwarded transparently tothe BSC as a data indication. By obtaining this data indication from theAbis interface, the location system would have access to the calledparty number. The BSC in turn forwards the setup message to the MSC. TheMSC examines the setup message contents and analyzes the MS's request.If for some reason it cannot accept or process the call, it sends back amessage to release the link. Assuming that the MSC will service thecall, it initiates whatever it needs to perform to establish theconnection on the external network side and, at the same time, sendstowards the MS a Call Proceeding message.

The Call Proceeding message passes transparently through the BSC and BTSand the message transmitted on the air interface. This message could beas simple and short as two octets; it serves to inform the MS that thecall establishment request has been received and that no more callestablishment information will be accepted (for now at least). Thebearer capability fields may be used in the cases when terminaladaptation is needed (generally not applicable for voice).

At initial assignment, the transmission mode is chosen by the BSC and itincludes one of the signaling only modes, in clear text. In the EuropeanGSM specification three radio assignment strategies are considered: VeryEarly Assignment, Early Assignment, and so-called Off-the-Air Call Setup(OACSU). In very early assignment a full rate channel is assigned assoon as it is apparent that a voice channel is likely needed, possiblyas early as the receipt of the channel request. In Early Assignment aDCCH, usually of the SDCCH/8 type, is first assigned for the duration ofthe signaling exchanges, and then when it is confirmed in the setupmessage that a voice channel is needed, then a full rate voice radiochannel is assigned. In the third strategy, OACSU, a voice radio channelis not assigned until the called party answers. This may save on radioresources but can result in the need for interim announcements after thecalled party answers and until the radio channel is assigned.

At present, an SDCCH/8 control channel is initially assigned forsignaling. More generally this could be a full rate SDCCH (basically avoice channel but in signaling mode). Subsequently, during the lifetimeof the RR session, the choice of transmission mode depends on thecommunication needs and is done by the MSC. The MSC can change the modeor channel at anytime during the RR connection, and does so via an“assignment” procedure.

In the most general case two cases exist: (1) the radio channel is tostay the same but its mode is to be changed, e.g., from one type oftraffic to another, and (2) a new radio channel is needed to meet thevoice communication requirements. The second case is the one applicableat present. (The first case would be more consistent with Very EarlyAssignment.)

To initiate the assignment procedure, the MSC sends a BSSMAP AssignmentRequest message to the BSC, which performs what is sometimes called aSubsequent Assignment procedure. The BSC sends to the BTS two messages,the first is a Channel Activation command, to configure and turn on therequired TRX for the new channel, and the second message is theAssignment Command to be sent on the existing DCCH. The AssignmentCommand is used when no new time advance needs to be conveyed to the MS.With the transmission of the Assignment Command, all signaling messagesnot related to RR management are suspended until completion ofassignment.

The Assignment Command is a transparent message as far as the BTS isconcerned and is sent to it as a data request. Obviously this is a keymessage that carries critical information if following the voice channelis of interest to the location system.

However, it also contains much additional information that is veryunlikely to be encountered in the case of normal voice service,particularly emergency calls.

Important elements in the message are the description of the firstchannel, and the power IE. The channel description fields have beendescribed earlier, and they contain the channel type, TN, the trainingsequence, and either the absolute radio frequency number or the hoppingsequence parameters (HSN, MAIO). The power command octet specifies theinitial power of the mobile; it has five bits that specify the binaryrepresentation of the power control level (range: 1-32).

The Assignment Command contains a host of other options. For example, asecond channel could also be described after a certain starting time.This pertains primarily to the case when the MS will have two dedicatedtraffic channels; it is intended for half-rate voice. The AssignmentCommand could also include new frequency lists for frequency hopping.These fields could be quite long (up to 132 octets each) and theircoding involved. Since frequency hopping is likely to be implemented inthe future, those fields would also need to be decoded if voice channeltracking is desired.

When the MS receives the Assignment Command it initiates the newconnection at the various layers. The new voice channel is establishedwith its associated signaling channels, the SACCH and FACCH, which aredistinct from the existing (sometimes called main) signaling channel,the DCCH, in use during the call setup. The MS waits for the startingtime to start the voice connection and transmission, but if the startingtime had already elapsed, it starts on the voice channel immediately asa reaction.

Upon completing the assignment, the MS transmits back to the BTS/BSC/MSCan Assignment Complete on the main DCCH. The Assignment Complete commandtransmitted over the air interface. The RR cause octet is “Normal Event”and its value is 00000000.

TABLE 2-16 Assignment Command Message Contents Pres- IEI InformationElement Reference ence Format Length RR management Protocol 10.2 M V 1/2Discriminator Skip Indicator 10.3.1 M V 1/2 Assignment Command 10.4 M V1 Message Type Description of the First 10.5.2.5 M V 3 Channel, aftertime Power Command 10.5.2.28 M V 1 05 Frequency List, after time10.5.2.13 C TLV 4-132 62 Cell Channel Description 10.5.2.1 O TV 17 63Mode of the First Channel 10.5.2.6 O TV 2 64 Description of the Second10.5.2.5 O TV 4 Channel, after time 66 Mode of the Second 10.5.2.7 O TV2 Channel 72 Mobile Allocation, after 10.5.2.21 C TLV 3-10 time 7CStarting Time 10.5.2.38 O TV 3 19 Frequency List, before time 10.5.2.13C TLV 4-132 1C Description of the First 10.5.2.5 O TV 4 Channel, beforetime 1D Description of the Second 10.5.2.5 O TV 4 Channel, before time1E Frequency channel 10.5.2.12 C TV 10 sequence, before time 21 MobileAllocation, before 10.5.2.21 C TLV 3-10 time 9- Cipher Mode Setting10.5.2.9 O TV 1

The BTS passes the assignment complete message transparently as a dataindication to the BSC. The BSC relays the corresponding MAP message onthe A-Interface. The MSC then sends an Alerting message to the MS toindicate that the called user at the fixed end has been alerted. This isa short message, with possible optional information that is not likelyto be used for normal or emergency voice calls. The Alert message isanother transparent message passed as a data request on the Abisinterface. The Alert message is sent over the air. The location systemwill likely have no need for the alerting message.

The MSC then sends a Connect message to indicate call acceptance by thecalled user. The basic part of this message is again short but there areoptions that could be many octets long, such as the called number andsubaddress. The MS stops its local alerting, if any, of the MSsubscriber and responds with a Connect Acknowledge which is the simpletwo octet message. Now, finally, the MS connects the speech path to theradio channel assigned to the voice and the conversation data flows. Atthis point, the DCCH is relinquished with an RF Channel Release sent tothe BTS, and becomes available to service another call setup.

TABLE 2-17 RF Channel Release (Section 8.4.14/GSM 08.58) INFORMATIONPRES- ELEMENT REFERENCE ENCE FORMAT LENGTH Message discriminator 9.1 M V1 Message type 9.2 M V 1 Channel number 9.3.1 M TV 2

TABLE 2-18 RF Channel Release Ack (Section 8.4.19/GSM 08.58) INFORMATIONPRES- ELEMENT REFERENCE ENCE FORMAT LENGTH Message discriminator 9.1 M V1 Message type 9.2 M V 1 Channel number 9.3.1 M TV 2

3. Mobile Terminated Call setup in a GSM System

A mobile terminated call setup in a GSM system includes the followingsteps:

Page from the network (Table 3-1).

Mobile terminal then responds with a Channel Request, with a response topage cause.

Immediate Assignment takes place.

The Page Response is transmitted once the SDCCH is assigned, instead ofa CM Service Request.

Authentication followed by encryption.

Network Sends a Setup Message to the Mobile terminal (Table 3-2).

Mobile terminal replies with a Call Confirmed Message.

Call then completes in the same manner as a mobile originated call.

From the Abis interface, the location system can determine the identityof the called party, as well as the physical resources used by the call.This information allows the location system to identify calls ofinterest, and locate the mobile phone receiving that call.

TABLE 3-1 Contents at the Page Response Message from the MS (Table9.25/GSM 04.08) Pres- IEI Information Element Reference ence FormatLength RR Management Protocol 10.2 M V 1/2 Discriminator Skip Indicator10.3.1 M V 1/2 Page Responset Message 10.4 M V 1 Type Ciphering KeySequence 10.5.1.2 M V 1/2 Number Spare Half Octet 10.5.1.8 M V 1/2Mobile Station Classmark 10.5.1.6 M LV 4 Mobile Identity 10.5.1.4 M LV2-9

TABLE 3-2 Setup Message for Mobile Terminating Call (Table 9.70/GSM04.08) Pres- IEI Information Element Reference ence Format Length CallControl Protocol 10.2 M V 1/2 Discriminator Transaction Identifier10.3.2 M V 1/2 Setup Message Type 10.4 M V 1 D- BC Repeat Indicator10.5.4.22 C TV 1 04 Bearer Capability 1 10.5.4.5 O TLV 3-10 04 BearerCapability 2 10.5.4.5 O TLV 3-10 1C Facility 10.5.4.15 O TLV 2-? 1EProgress Indicator 10.5.4.21 O TLV 4 34 Signal 10.5.4.23 O TV 2 5CCalling Party BCD Number 10.5.4.9 O TLV 3-14 5D Calling PartySub-address 10.5.4.10 O TLV 2-23 5E Called Party BCD Number 10.5.4.7 OTLV 3-13 6D Called Party Sub-address 10.5.4.8 O TLV 2-23 D- LLC RepeatIndicator 10.5.4.22 O TV 1 7C Low Layer Compatibility I 10.5.4.18 O TLV2-15 7C Low Layer Compatibility II 10.5.4.18 C TLV 2-15 D- HLC RepeatIndicator 10.5.4.22 O TV 1 7D High Layer Compatibility I 10.5.4.16 O TLV2-5 7D High Layer Compatibility II 10.5.4.16 C TLV 2-5 7E User-user10.5.4.25 O TLV 3-35

4. System Architecture for GSM

An illustrative system architecture for the location of GSM mobilephones is shown in FIG. 12Q. The main modification to support GSM is theaddition Abis Monitoring Subsystem (AMS). The AMS monitors the signalinglinks on the Abis interface. A second modification is the NSS InterfaceSystem (NIS), which obtains a mapping of the TMSI to the IMSI and MSISDNfor a subscriber, and can provide a subscriber the current location inthe form of a short message.

The AMS will continuously monitor the Layer 2 LAPD signaling links onthe Abis interface, for each cell in the GSM system. The AMS willmonitor the LAPD frames and identify Immediate Assign Command messages.The AMS need not monitor the Channel Required messages, because allrelevant information in the Channel Required message is repeated in theImmediate Assign Command. From the Immediate Assign Command, the AMS canidentify emergency calls, and a description of the radio channel usedfor the subsequent signaling messages.

Once the Immediate Assign Command is detected, for a particular logicalchannel, the Abis message processor knows a new origination hasoccurred, and a new call record is created. The Abis processor will thenlook for a CM Service Request message from the channel, which willidentify the mobile subscriber. The raw bits and the mobile identity areappended to the call record. The AMS then sends an origination indicatormessage with a hash code to the TLP, and the TLP then sends a TDOA datarequest to the appropriate SCSs with the same hash code, for up to 12bursts allocated to the mobile starting with the CM service request. TheTDOA data will be cached by the SCS.

The AMS will then capture and store in the call record, all messagesfrom that mobile until it receives the setup message. Once the setupmessage is received, all information is available to determine if alocation should be performed. The full origination, along with themobile transmitted bits for the first 12 bursts are sent to the TLP.Missing frames will be indicated, and fill frames should be assumed.

With the complete origination information, the TLP will determine if aposition determination is required. If so, the TLP will send a TOA\FOArequest to the primary SCS. The request is similar to a TDOA request,but will also provide the uncoded data bits. The primary SCS will thenreply with the TOA, FOA, frequency offset, and phase corrections (ifrequired) for each burst. The SCS will also provide SNR metrics for eachburst.

The TLP will then send a TOA/FOA request to each of the SCSs, with thecorrections from the primary channel. The SCSs will process the data,and reply to the TLP with TOA, and FOA. The TLP will then execute thesolve algorithm, and the position is determined.

The NIS will request the IMSI and MSISDN from the VLR, when needed. TheNIS will support the protocol stack for communication over the SS7network, which allows communication with GSM VLRs, HLRs and MSCs.

Once the location is determined, the AP has the subscriber'sinformation, and current location. If the subscriber has locationservice, the AP would send the location information to the NIS, alongwith the IMSI, MSISDN, and routing information to the subscriber'scurrent MSC. The NIS would then forward the location information to thesubscriber in the form of a short message.

The location service could be a supplementary service defined in thesubscriber's information or kept in the AP database.

4.1 SCS Modifications

The SCS is not required to demodulate and identify all originationmessages from the mobile phones. This will be accomplished by monitoringthe Abis interface. For station based processing, the SCS may have todemodulate only the bursts used for location, if those bits cannot becompletely determined from the Abis interface, in cases of voicetracking.

The SCS would, upon the receipt of a RACH Demod Request message from theTLP, search and demodulate a Random Access (RACH) Burst. The RACH DemodRequest will contain the ARFCN, a time window to search, and thecontents of the RACH message to be demodulated. Upon successfuldemodulation and decoding of the RACH burst, the SCS may provide a RACHDemod Response message, with a time stamp to the TLP, indicating whenthe RACH burst occurred. If the RACH burst cannot be found, the SCS mayprovide an error message to the TLP, indicating that the RACH was notfound.

The SCS could provide 200 kHz complex video bandwidth for TDOA data. TheSCS could also provide the demodulated bits for a series of bursts uponrequest by the TLP, and may also provide frequency and phase correctionsfor each of these bursts (if necessary for accuracy). This could be sentto the other SCSs to be used for station based processing. The SCS couldalso provide a periodic message to the TLP, bound for the AMS, whichindicates the time drift between GPS and the T1 frame clock.

Frame timing to the accuracy of a few microseconds can be initiallydetermined by a search of a short burst (maybe a RACH burst) for eachsite in the system. This timing can then be maintained by counting theT1 frames in one of the SCSs, and calculating Tdrift. Also, the TOAcould be used to update the timing with each location. Upon receipt of acall cancel message, the SCS could match the hash code with the TDOAdata stored in cache, and delete that TDOA data.

4.2 TLP Modifications

The TLP could be made to accept originations from the AMS, instead ofthe SCSs. The origination could be sent to the TLP in 2 messages, whichcan be linked by a hash code. The first message is just an indicationthat an origination has begun, and will include a timestamp. Thismessage allows the TLP to start the TDOA data caching process. Thiscaching process is probably not needed, as the phone does not reducepower for several seconds. Data can be collected once an SOI isdetermined, from information in the seconds message. The second messagewill contain all information necessary for an origination (MIN, DialedDigits).

The TLP could also provide a link in which the AMS can request aparticular SCS to demodulate a RACH burst, and provide a timestamp backto the AMS. The TLP could accept RACH Demod Request Messages from theAMS and forward them to the appropriate SCS. The TLP could also AcceptRACH demod response messages from the SCS and forward them to theappropriate AMS. This allows the location system to know the relativetiming of each Base Stations frame epoch.

Upon receipt of a call cancel message from the AMS, the TLP would linkthat call cancel message to the origination message, and send a callcancel message to the appropriate SCSs. The TLP will then delete theorigination form its memory.

4.3 Changes to the AP

The AP could be made to have an interface to the NIS, for the purpose ofsending short location related messages to mobile subscribers. Thefunctionality of the NIS could be added to the AP, making the AP to NISan internal interface.

4.4 Abis Monitoring System (AMS)

4.4.1 Call Tracking

The AMS may have a connection to the Abis interface of a BSC in the GSMsystem. This connection may provide the AMS bidirectional monitoringaccess to the Abis interface for each BTS under control of the BSC. TheAMS may monitor the LAPD signaling link for the beacon TRX, for eachcell, to allow location upon origination of calls. The AMS architecturemay expand to monitor the LAPD signaling links for each TRX, for allcells controlled by the BTS, to allow location using traffic channels.The AMS architecture may allow expansion to support up to 2000 LAPDsignaling links. The AMS may detect call originations through theImmediate Assign Command. The AMS may identify emergency calls from theImmediate Assign Command.

Upon receipt of an Immediate Assign command, the AMS may notify theappropriate TLP within 25 milliseconds. The AMS may provide to the TLPwith an origination indication, including a description of the physicalchannel assignment, a timestamp, and a hash code to link with theorigination information later. This hash code may also permit the TLP torequest current physical channel information about a particular call,after voice channel assignment. (The same hash code is used throughoutthe duration of the call.) This process could wait for systems in whichpower control does not take effect for several seconds (EricssonOmnipoint), and a single origination message could be sent to the TLP.

The AMS may detect CM Service Request, Page Response, and LocationUpdate Request, and link them to the Immediate Assign Command for agiven call setup.

The AMS may detect Setup messages and Link them to the Immediate AssignCommand for a given call setup.

If an Immediate Assign Command for a particular physical channel is sentto the BTS before all of the origination information is gathered for theprevious call, the AMS may send a call cancel message to the TLP,including the same hash code used for the origination indicationmessage.

When the AMS has the complete origination information, consisting of thephysical channel, Mobile identity, and dialed digits, the AMS mayforward this origination information to the TLP along with the same hashcode used for the origination indication.

The AMS may detect Assignment Commands and Assignment Complete responsessent over Abis interface for a given call, and link them to the originalImmediate Assign Message.

The AMS may detect subsequent Hand-over Commands and Hand-over Failuresto maintain the most up to date physical channel assignment for a givencall. (Assignment commands).

The AMS may accept Physical Channel request from the TLP. The TLP willprovide the unique hash code which the AMS provided with theorigination. The AMS may respond with a complete description of thePhysical channel currently assigned to the call, or an indication thatthe AMS does not have the information. This will permit voice tracking,which is initiated by the TLP.

The AMS may support inter AMS communication allowing inter BSC/MSChand-over of call records. The Hand-over Command on the Abis interfaceprovides the new cell ID, and hence the new AMS ID. Upon successfulhand-over, the AMS will append the new physical channel information tothe call record, and send the entire call record to the new AMS, if thecall is to be serviced by a different AMS.

The AMS may support up to 160 call arrivals per second.

4.3.2 TRX Configuration Maintenance

The AMS may have provided to it the configuration of each TRX controlledby the BSC. The configuration is defined as the TSC, a bit to indicateif frequency hopping is applied, the MAIO and HSN if frequency hoppingis applied, or the ARFCN if frequency hopping is not applied. The AMSmay maintain knowledge of the TRX configuration by the followingalgorithm:

For each Assignment Command, or Immediate Assignment command, comparethe Channel Description IE to the Channel Number IE of the n most recentsuccessful Channel Activation Commands. Successful Channel ActivationCommands are defined as those with a Channel Activation Ack from theBTS. If the Channel Number IE of the Channel Activation matches thematches the Channel type and TDMA offset field, and the TN field of theChannel Description IE of the Assignment or Immediate Assignment Commandof any of the n Channel Activation messages, store the TSC, H, MAIO andHSN, and ARFCN fields of the Channel Description IE. The AMS shouldmaintain a list of the fields from the last m Channel Description IEs,for each TRX. When any new Channel Description IE fields are added tothe list, the new TRX configuration is defined as the configurationappearing most in the list of length m. If there is a tie, then the TRXconfiguration may not be updated. If there are less than m sets ofconfiguration values, the configuration may not be updated.

The parameter n may be an operator configurable parameter with a rangeof 1 to 12, a step size of 1, and a default value of 2. The parameter mmay be an operator configurable parameter with a range of 1 to 12, astep size of 1, and a default value of 5.

The TRX configuration should be static, and any changes in TRXconfiguration should be known by the location system operator some timebefore the change takes place. However, if the operator is not informed,the AMS will typically learn the new configuration after m/2+1 callsusing that TRX.

4.3.3 Synchronization Maintenance

Upon initialization the AMS may monitor the signaling links on the Abisinterface for a Channel Required message for each cell controlled by theBSC. Upon the receipt of the first Channel Required Message for a givencell, the AMS may store the frame number, F0, and time offset for themessage, and request a timestamp determination from the TLP for thatcorresponding Channel Request message. In this request the AMS mayinclude the ARFCN, a start time, and a search window length, the ChannelRequest message contents, and a unique hash code. The search windowlength, W1 may be an operator configurable parameter with a range of 1to 500 milliseconds, with a step size of 1 millisecond, and a defaultvalue of 100 milliseconds. The TLP will forward this message to theappropriate SCS and eventually reply with a timestamp, and a signalquality measurement, if the burst is found, other wise, an indicationthat the burst was not found. If the burst was not found, the AMSrepeats the process with the next Channel Required message.

When the AMS finally receives a successful timestamp for the burst, itcalculates the time of the Epoch of the stored frame as GPStimestamp—Access delay, T0. Any subsequent frame epoch can be determinedby:

Tframe=(F 1−F 0)*60/13+T 0.

The epoch for any TNx in a frame can be determined by:

Tframe+x15/26 milliseconds.

Upon successful determination of the frame epoch, the AMS may start aTimer, T501. When the timer expires, the AMS may reinitiate the epochcapture procedure. T501 may be an operator configurable parameter with arange of 1 second to 36000 seconds with a one-second-step size, and adefault value of 900 seconds.

A single SCS will be configured to proved a time drift measurement,Tdrift, between the GPS time and the T1 clock. This SCS will provide adrift offset once each L seconds. Each L seconds the Tframe may beadjusted by the Tdrift. L may be an operator configurable parameter witha range of 1 to 900 seconds, step size of 1 seconds and a default valueof 10 seconds.

4.4 NIS

The NIS could be part of the AP, and therefore need not have an explicitinterface to the AP.

4.4.1 Subscriber Identification

The NIS may connect to the all VLRs in a GSM network. The NIS mayconnect to up to 5 VLRs. The NIS may comply with GSM 09.02 forcommunication with the VLR. The VLR may have a link to each AMS in thenetwork. The NIS may support link for up to 10 AMS in the network.

The NIS may accept subscriber information request messages from each AMSin the network. The subscriber request may contain the subscriber'sTMSI, or IMSI, and the VLR number with which the subscriber isregistered. Upon receiving the subscriber request message, the NIS mayissue a send parameters command to the appropriate VLR, and request thesubscriber information. Upon successful reception of the subscriberinformation from the VLR, the NIS may forward it to the requesting AMS.If the request was unsuccessful, an error message may be forwarded tothe requesting AMS.

4.4.2 Short Message Service

The NIS may provide an interface to the AP. This interface will allowthe AP to send short messages to a subscriber, containing thesubscriber's location, or any location related data. The NIS may acceptSMS requests from the AP, and forward the short messages to theappropriate MSC. Upon successful delivery of the short message, the NISmay provide an acknowledgement to the AP. If the network wasunsuccessful delivering the message, the NIS may inform the AP. The NISmay comply with GSM specification 09.02, when communicating with theNetwork.

Conclusion

The true scope the present invention is not limited to the presentlypreferred embodiments disclosed herein. For example, the foregoingdisclosure of a presently preferred embodiment of a Wireless LocationSystem uses explanatory terms, such as Signal Collection System (SCS),TDOA Location Processor (TLP), Applications Processor (AP), and thelike, which should not be construed so as to limit the scope ofprotection of the following claims, or to otherwise imply that theinventive aspects of the system are limited to the particular methodsand apparatus disclosed. Moreover, as will be understood by thoseskilled in the art, many of the inventive aspects disclosed herein maybe applied in location systems that are not based on TDOA techniques.For example, the processes by which the Wireless Location Systemdetermines TDOA and FDOA values can be applied to non-TDOA systems.Similarly, the invention is not limited to systems employing SCS'sconstructed as described above, nor to systems employing AP's meetingall of the particulars described above. The SCS's, TLP's and AP's are,in essence, programmable data collection and processing devices thatcould take a variety of forms without departing from the inventiveconcepts disclosed herein. Given the rapidly declining cost of digitalsignal processing and other processing functions, it is easily possible,for example, to transfer the processing for a particular function fromone of the functional elements (such as the TLP) described herein toanother functional element (such as the SCS or AP) without changing theinventive operation of the system. In many cases, the place ofimplementation (i.e., the functional element) described herein is merelya designer's preference and not a hard requirement. Accordingly, exceptas they may be expressly so limited, the scope of protection of thefollowing claims is not intended to be limited to the specificembodiments described above.

What is claimed is:
 1. A method for use in a wireless location system(WLS) that estimates the geographic location of a mobile station (MS),wherein the WLS overlays at least a portion of the geographic area of awireless communications system, wherein the WLS uses radio resources andlocation processing resources to locate said MS using a processinvolving receiving a transmission from the MS at multiple signalcollection sites and processing the received transmissions to estimatethe location of the MS using time difference of arrival (TDOA) and/orangle of arrival (AOA) location processing techniques, wherein thewireless communications system includes base transceiver station (BTS)equipment connected to base station controller (BSC) equipment,comprising the steps of: continuously, passively monitoringcommunications between at least one BTS and at least one BSC, extractingMS information from the monitored communications, said extracted MSinformation including radio frequency channel information sufficient toenable the WLS to receive transmissions from the MS for locationpurposes; and using the extracted MS information to trigger TDOA and/orAOA location processing for said MS and to determine which radiofrequency channel to use in performing location processing for said MS.2. A method as recited in claim 1, wherein the extracted MS informationfurther comprises at least one of: the mobile station identification(MSID), the called number dialed by the user of the MS, or the contentsof messages sent to the MS or from the MS.
 3. A method as recited inclaim 1, wherein the extracted MS information further comprises at leastone of the following presently in use by the MS the control channel, thetraffic channel, the mobile directory number (MDN), the ElectronicSerial Number (ESN), the Mobile Identity Number (MIN), the MobileSubscriber Identification (MSI), the international mobile subscriberidentity (IMSI), the temporary mobile subscriber identity (IMSI), or themobile station international ISDN number (MSISDN).
 4. A method asrecited in claim 1, wherein the WLS stores the extracted MS informationin a database.
 5. A method as recited in claim 4, wherein the WLSremoves the extracted MS information from the database after theextracted MS information is no longer valid.
 6. A method as recited inclaim 5, wherein the extracted MS information is determined to be nolonger valid because the MS is no longer registered with the wirelesscommunications system.
 7. A method as recited in claim 5, wherein theextracted MS information is determined to be no longer valid because apredetermined period of time has expired.
 8. A method as recited inclaim 5, wherein the extracted MS information is determined to be nolonger valid because a predetermined period of time has expired withoutan update to the extracted MS information.
 9. A method as recited inclaim 1, wherein the WLS discards the extracted MS information if theextracted MS information does not match any of a set of predeterminedcriteria.
 10. A method as recited in claim 9, wherein the set ofpredetermined criteria includes at least one of the following:information about the identity of the MS or the number called by the MS.11. A method as recited in claim 1, wherein the extracted MS informationcomprises an establishment cause of a channel request message indicativeof an emergency call.
 12. A computer readable medium comprising computerexecutable instructions for carrying out the method of claim
 1. 13. Amethod for use in a wireless location system (WLS), wherein the WLSoverlays at least a portion of a wireless communications system thatincludes base transceiver station (BTS) equipment operatively coupled tobase station controller (BSC) equipment via an interface, comprising thesteps of: passively monitoring communications on the interface betweenat least one BTS and at least one BSC; identifying certain prescribedmobile station (MS) information from the monitored communications, saidinformation including an emergency call indication, radio frequencychannel number and timeslot number; using the MS information todetermine whether to perform location processing for said MS and todetermine which radio channel to use in performing location processingfor said MS; and performing time difference of arrival (TDOA) and/orangle of arrival (AOA) location processing for said MS, whereby anaccurate location estimate is obtained for said MS.
 14. A method asrecited in claim 13, wherein the MS information includes one or more ofthe following: a mobile station identification (MSID), a called number,contents of messages sent to the MS or from the MS, and/or frequencyassignment information sent to the MS.
 15. A method as recited in claim13, wherein the MS information includes one or more of the followingpresently in use by the MS: control channel, traffic channel, mobiledirectory number (MDN), Electronic Serial Number (ESN), Mobile IdentityNumber (MIN), Mobile Subscriber Identification (MSI), internationalmobile subscriber identity (IMSI), temporary mobile subscriber identity(IMSI), and/or mobile station international ISDN number (MSISDN).
 16. Amethod as recited in claim 13, wherein the WLS stores the MS informationin a database.
 17. A method as recited in claim 16, wherein the WLSremoves the MS information from the database after the MS information isno longer valid.
 18. A method as recited in claim 17, wherein the MSinformation is determined to be no longer valid because the MS is nolonger registered with the wireless communications system.
 19. A methodas recited in claim 17, wherein the MS information is determined to beno longer valid because a predetermined period of time has expired. 20.A method as recited in claim 17, wherein the MS information isdetermined to be no longer valid because a predetermined period of timehas expired without an update to the MS information.
 21. A method asrecited in claim 13, wherein the WLS discards the MS information if theMS information does not march any of a set of predetermined criteria.22. A method as recited in claim 21, wherein the set of predeterminedcriteria includes information about the identity of the MS or the numbercalled by the user of the MS.
 23. A method as recited in claim 13,wherein the extracted MS information comprises an establishment cause ofa channel request message indicative of an emergency call.
 24. Acomputer readable medium comprising computer executable instructions forcarrying out the method of claim
 13. 25. A wireless location system(WLS) that overlays at least a portion of a wireless communicationssystem that includes base transceiver station (BTS) equipmentoperatively coupled to base station controller (BSC) equipment via aninterface, comprising: means for passively monitoring communications onthe interface between at least one BTS and at least one BSC; means foridentifying certain prescribed mobile station (MS) information from themonitored communications, said information including an emergency callindication, radio frequency channel number and timeslot number; andmeans for using the MS information to determine whether to performlocation processing for said MS and to determine which radio channel touse in performing location processing for said MS.
 26. A system asrecited in claim 25, wherein the MS information includes one or more ofthe following: a mobile station identification (MSID), a called number,contents of messages sent to the MS or from the MS, and/or frequencyassignment information sent to the MS.
 27. A system as recited in claim25, wherein the MS information includes one or more of the followingpresently in use by the MS: control channel, traffic channel, mobiledirectory number (MDN), Electronic Serial Number (ESN), Mobile IdentityNumber (MIN), Mobile Subscriber Identification (MSI), internationalmobile subscriber identity (IMSI), temporary mobile subscriber identity(IMSI), and/or mobile station international ISDN number (MSISDN).
 28. Asystem as recited in claim 25, further comprising a database, whereinthe WLS stores the MS information in said database.
 29. A system asrecited in claim 28, wherein the WLS removes the MS information from thedatabase after the MS information is no longer valid.
 30. A system asrecited in claim 29, wherein the MS information is determined to be nolonger valid because the MS is no longer registered with the wirelesscommunications system.
 31. A system as recited in claim 29, wherein theMS information is determined to be no longer valid because apredetermined period of time has expired.
 32. A system as recited inclaim 29, wherein the MS information is determined to be no longer validbecause a predetermined period of time has expired without an update tothe MS information.
 33. A system as recited in claim 25, wherein the WLSdiscards the MS information if the MS information does not match any ofa set of predetermined criteria.
 34. A system as recited in claim 33,wherein the set of predetermined criteria includes information about theidentity of the MS or the number called by the user of the MS.
 35. Asystem as recited in claim 25, wherein the extracted MS informationcomprises an establishment cause of a channel request message indicativeof an emergency call.
 36. A method for use in a wireless location system(WLS) that estimates the geographic location of a mobile station (MS),wherein the WLS overlays at least a portion of the geographic area of awireless communications system, wherein the WLS includes radio resourcesand location processing resources and uses said resources to locate saidMS using a process involving receiving a transmission from the MS atmultiple signal collection sites and processing the receivedtransmissions to estimate the location of the MS using time differenceof arrival (TDOA) and/or angle of arrival (AOA) location processingtechniques, wherein the wireless communications system includes basetransceiver station (BTS) equipment connected to base station controller(BSC) equipment, and wherein said radio resources of the WLS may be atleast partially co-located with said BTS equipment of the wirelesscommunications system but are different from said BTS equipment,comprising the steps of: continuously passively monitoring thecommunications between at least one BTS and at least one BSC, andextracting MS information from the monitored communications, and usingthe extracted MS information to trigger location processing and todetermine channel assignment information for said MS, to enable the WLSto receive transmissions from the MS for location purposes; wherein theextracted MS information comprises at least one of: the mobile stationidentification (MSID), the called number dialed by the user of the MS,the contents of messages sent to the MS or from the MS, or frequencyassignment information sent to the MS.
 37. A computer readable mediumcomprising computer executable instructions for carrying out the methodof claim
 36. 38. A method for use in a wireless location system (WLS)that estimates the geographic location of a mobile station (MS), whereinthe WLS overlays at least a portion of the geographic area of a wirelesscommunications system, wherein the WLS includes radio resources andlocation processing resources and uses said resources to locate said MSusing a process involving receiving a transmission from the MS atmultiple signal collection sites and processing the receivedtransmissions to estimate the location of the MS using time differenceof arrival (TDOA) and/or angle of arrival (AOA) location processingtechniques, wherein the wireless communications system includes basetransceiver station (BTS) equipment connected to base station controller(BSC) equipment, and wherein said radio resources of the WLS may be atleast partially co-located with said BTS equipment of the wirelesscommunications system but are different from said BTS equipment,comprising the steps of: continuously passively monitoring thecommunications between at least one BTS and at least one BSC, andextracting MS information from the monitored communications, and usingthe extracted MS information to trigger location processing and todetermine channel assignment information for said MS; to enable the WLSto receive transmissions from the MS for location purposes; wherein theextracted MS information comprises at least one of the followingpresently in use by the MS: the control channel, the traffic channel,the mobile directory number (MDN), the Electronic Serial Number (ESN),the Mobile Identity Number (MIN), the Mobile Subscriber Identification(MSI), the international mobile subscriber identity (IMSI), thetemporary mobile subscriber identity (IMSI), or the mobile stationinternational ISDN number (MSISDN).
 39. A computer readable mediumcomprising computer executable instructions for carrying out the methodof claim
 38. 40. A method for use in a wireless location system (WLS)that estimates the geographic location of a mobile station (MS), whereinthe WLS overlays at least a portion of the geographic area of a wirelesscommunications system, wherein the WLS uses radio resources and locationprocessing resources to locate said MS using a process involvingreceiving a transmission from the MS at multiple signal collection sitesand processing the received transmissions to estimate the location ofthe MS using time difference of arrival (TDOA) and/or angle of arrival(AOA) location processing techniques, wherein the wirelesscommunications system includes base transceiver station (BTS) equipmentconnected to base station controller (BSC) equipment, comprising thesteps of: passively monitoring communications between at least one BTSand at least one BSC, wherein the monitored communications containindications of a call origination or call termination; and using themonitored information to trigger location processing for said MS and todetermine which radio resources to use in performing TDOA and/or AOAlocation processing for said MS.
 41. A method as recited in claim 40,wherein the step of monitoring communications includes monitoringmessages containing radio frequency channel information, and wherein theradio frequency channel information as used to identify a radio channelto which receivers of the WLS are tuned.
 42. A method as recited inclaim 41, wherein said radio frequency channel information includesStandalone Digital Control Channel Information.
 43. A method as recitedin claim 41, wherein said radio frequency channel information includesDigital Control Channel Information.
 44. A method as recited in claim41, wherein said radio frequency channel information includes TrafficChannel Information.
 45. A method as recited in claim 41, wherein theradio frequency channel information includes an Absolute Radio FrequencyChannel Number, Timeslot number, Subchannel number, and TrainingSequence Code.
 46. A method as recited in claim 41, wherein the radiofrequency channel information includes a Hopping Sequence number, MobileAllocation Index Offset, Hopping Flag, Mobile Allocation, and CellAllocation.
 47. A method as recited in claim 40, wherein the step ofmonitoring communications includes monitoring messages containing theidentity of the mobile station.
 48. A method as recited in claim 47,wherein the identify of the MS is compared to a table of mobile stationsof interest.
 49. A method as recited in claim 40, wherein the step ofmonitoring comprises monitoring communications containing indications ofan emergency call origination.
 50. A method as recited in claim 49,wherein the emergency call indication is contained in a Channel Requestmessage as an Establishment cause value of binary 10100000 to 10111111.51. A method as in claim 50, wherein a Request Reference is used to linkA-bis messages to location events.
 52. A method as recited in claim 49,wherein the said emergency call indication is determined from monitoringuse of an Emergency Setup message.
 53. A method as in claim 40, whereinthe step of monitoring communications includes monitoring for anImmediate Assignment Command.
 54. A computer readable medium comprisingcomputer executable instructions for carrying out the method of claim40.
 55. A system for use in a wireless location system (WLS) thatestimates the geographic location of a mobile station (MS), wherein theWLS overlays at least a portion of the geographic area of a wirelesscommunications system, wherein the WLS uses radio resources and locationprocessing resources to locate said MS using a process involvingreceiving a transmission from the MS at multiple signal collection sitesand processing the received transmissions to estimate the location ofthe MS using time difference of arrival (TDOA) and/or angle of arrival(AOA) location processing techniques, wherein the wirelesscommunications system includes base transceiver station (BTS) equipmentconnected to base station controller (BSC) equipment, comprising: meansfor passively monitoring communications between at least one BTS and atleast one BSC, wherein the monitored communications contain indicationsof a call origination or call termination; and means for using theextracted MS information to trigger location processing for said MS andto determine which radio resources to use in performing TDOA and/or AOAlocation processing for said MS.
 56. A system as recited in claim 55,wherein the means for monitoring communications monitors messagescontaining radio frequency channel information.
 57. A system as recitedin claim 56, wherein said radio frequency channel information includesStandalone Digital Control Channel Information.
 58. A system as recitedin claim 56, wherein said radio frequency channel information includesDigital Control Channel Information.
 59. A system as recited in claim56, wherein said radio frequency channel information includes TrafficChannel Information.
 60. A system as recited in claim 56, wherein theradio frequency channel information includes an Absolute Radio FrequencyChannel Number, the Timeslot number, Subchannel number, and TrainingSequence Code.
 61. A system as recited in claim 56, wherein the radiofrequency channel information includes Hopping Sequence number, MobileAllocation Index Offset, Hopping Flag, Mobile Allocation, and CellAllocation.
 62. A system as recited in claim 55, wherein the means formonitoring communications monitors messages containing the identity ofthe mobile station.
 63. A system as recited in claim 62, furthercomprising means for comparing the identify of the mobile station to atable of mobile stations of interest.
 64. A system as recited in claim55, wherein the means for monitoring monitors communications containingindications of an emergency call origination.
 65. A system as recited inclaim 64, wherein the emergency call indication is contained in aChannel Request message as an Establishment cause value of binary10100000 to
 10111111. 66. A system as in claim 65, wherein a RequestReference is used to link A-bis messages to location events.
 67. Asystem as recited in claim 64, wherein the emergency call indication isdetermined from monitoring of use of an Emergency Setup message.
 68. Asystem as in claim 55, wherein the monitored communications includes anImmediate Assignment Command.